Hacker News Reader

Comment by golem_de | Hacker News Reader

https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/vie... Line 56: _password = Column('password', Unicode)

From the text:

"To answer the question that at least a few dozen of you are looking for: Mailman 3 will not, by default, send you a monthly reminder that includes your password in plain text. In fact, it can't; Mailman 3 hashes passwords before storing them."

Most of the way I'm reminded that a list I'm on uses Mailman is that it mails me my password in plain text every month.

So, it's unfortunate, but it's nothing new.

As I understand it from the write-up (and a brief look at the source seems to confirm that), Mailman 3.0 does encrypt passwords by default and does not mail them out any longer.

It is stored in unicode because that's what passlib hash algorithms return, not because there's an underlying plaintext representation.

It hashes password.

Encrypting them indicates there's a way to decrypt them. Hashing, by definition, is not possible (not practical, really).

If there are better mailing list software, what are they?

Sorry, I couldn't resist. Look on that 'user' table! Does anyone have a copy of lists.mozilla.org? hehe

Can you help me understand the issue you see here?

Deleted comment

> But the code you are pointing out is not using hashing(&salting) at all, I'm confused.

That's just the storage backend. Encryption is not handled at this layer, but at (e.g.):

https://bazaar.launchpad.net/~mailman-coders/mailman/3.0/vie...

Reply on news.ycombinator.com