Hacker News Reader

Can you give an example for why that signup code is bad? In the case that I'm using Hoodie with CouchDB, wouldn't Hoodie just AJAX post a user document to the CouchDB _users database (which is a good implementation)? All of the access control would be in the hands of the server with minimal (if any at all) security logic in the front end.

Yeah, but you're going to see a <form> that POSTs to some target URL, with username and password as fields. The only thing protecting the plaintext password from leaking is SSL. POSTing a XmlHttpRequest is equivalent.

They have frontend code that will talk to /singup or whatever the route for creating an account is. Hoodie does nothing different.

Thanks for the pointer to Jeremiah, though :)

the signup seems to be handled by couchdb.