Looking for a co-founder? post here (3 rules apply)

Re:Looking for a co-founder? post here (3 rules apply) by anewaccountname on Sunday February 17, 2008 @01:51AM (#117422)

By the way, while we are on this topic--can you confirm that passwords are not stored in plain-text?

[ Parent | on HN ]

Re:Looking for a co-founder? post here (3 rules apply) by pg on Sunday February 17, 2008 @08:19AM (#117569)

Sure. You can see for yourself in the source: http://ycombinator.com/arc/arc1.tar

[ Parent | on HN ]

Re:Looking for a co-founder? post here (3 rules apply) by brett on Sunday February 17, 2008 @11:56AM (#117638)

On disk at least. They're temporarily logged to memory in the clear:

  (def good-login (user pw ip)
    (let record (list (seconds) ip user pw)
      (if (and user pw (aand (shash pw) (is it (hpasswords* user))))
          (do (unless (user->cookie* user) (cook-user user))
              (enq-limit record good-logins*)
              user)
          (do (enq-limit record bad-logins*)
              nil))))

It might be good to pull the pw out of the record list:

  ...
   (let record (list (seconds) ip user)
     ...

[ Parent | on HN ]

Re:Looking for a co-founder? post here (3 rules apply) by pg on Monday February 18, 2008 @02:53AM (#118008)

Ok, I took it out. Turns out nothing later ever needs the pw anyway.

[ Parent | on HN ]

Re:Looking for a co-founder? post here (3 rules apply) by jsjenkins168 on Sunday February 17, 2008 @02:38PM (#117708)

I hope you are not reusing an important password for this site.. Even if they are hashed on the disk, they are sent insecurely to the server when you log in.

[ Parent | on HN ]