Hacker News Reader

Comment by danpalmer | Hacker News Reader

Can you update the blog post to remove the wording "encrypted". That is simply incorrect. There is a clear and incredibly important difference between hashing and encrypting, the latter being designed to be reversible.

I'd appreciate a description of the hashing algorithm being added to the blog post, but that's less important.

If you say "encrypted", I read that as "somewhere we have a key that gives the attacker plaintext passwords, they might have that key as well".

View on HN

This wouldn't be pedantic if we were discussing communications between cryptographers and other technologists, but this is a public notice, and so the point is very pedantic. For all intents and purposes, the password hash or authenticator of a password is its "encryption", in the layperson's sense.

Exactly.

In business the "simplicity abstraction layer" [1] on a product is essentially taking something that was created by hackers for hackers (or engineers) and making it simple for end users "the layperson".

God knows anytime you can make something easy for a layperson and not make them think there is money to be made. They aren't interested in your Liebert fire protection system and diverse path routing.

It never fails to amaze me how highly technical types simply can't think out of that box. And yet they make fun of "sales types" that can actually speak and sell to end users an inferior product.

[1] I actually just made that up.

But still, you could write "Our passwords are stored securely using the bcrypt algorithm; however, weak passwords..." and not compromise terms.

Hashing is often referred to as one-way encryption.

For example: http://publib.boulder.ibm.com/infocenter/zvm/v5r4/index.jsp?...

When communicating with the general public, it's useful to use words they understand.

The difficulty of linking to a high level definition of a hash function and its differences to encryption is not very high.

If a customer were to be curious as to what hashing is then that link should clear it up perfectly.

Missing the point. Most of the customers do not know or care what the difference is, will never read any definition or explanation of it, and shouldn't have to. If you try to force your customers to understand this stuff, they'll get confused and annoyed, and go with someone else who can make it clear for them.

Do you thoroughly research the scientific, business, legal, medical, philosophical, religious, etc. underpinnings of every article you read? Just because you're knowledgable in this area doesn't mean everybody should be. Using the term "encrypted" rather than "hashed" is perfectly appropriate for a general press release. This is a highly pedantic criticism.

Reply on news.ycombinator.com