If they'd just said "We securely store your passwords", they would have tech people with pitchforks and torches about how they need to name their password hashing algorithm.
If they'd explained both ways, somebody would accuse them of the notification being too long as part of a scheme to bury the details below the fold.
As a company reporting an issue, no matter what you do, the internet's gonna nit pick
Serious question: Do you need the non-techy explanation?
no.. but I could be a non IT user using hipchat. This sentence is likely meaningless to me.
Is that a problem? I guess they could have put a "technical details:" in front of it, to make that clearer, but it has to be in that e-mail (otherwise the techies complain) and isn't really something they can explain in a useful way there.
Then you would be fine with the standard boilerplate "your data is secure with us"?
I'm happy they say this.. now i'd like some sort of proof :-)
A follow up sentence that re-iterates the same sentiment in non technical term will accommodate none technical recipients.
Poor UX is my point of this
Better would be "We securely[1] store your passwords"
blah blah...We take your privacy very seriously...blah blah...
[1] Technically, we use bcrypt with a random salt.
An argument could be made to take this a step further and not even go into buzzword details at all, and leave it with boilerplate words.
Security is hard. Describing security is even harder.
I'm for transparency in security for review, but you can achieve the same via a 3rd party audit.
Just my 2c.
Googling bcrypt should do the trick and most people know how to do that. </sarcasm>
you're joking I assume. If not, don't be in the UX field
"HipChat hashes passwords using bcrypt with a random salt."
This is a good example of how not to do mass e-mails targeting the general population.