To play devil’s advocate, to me plaintext means I want to finish quickly because you haven’t asked and are paying too little, while any solution other than bcrypt/pbkdf2 means I don’t know what I’m doing.

Having once run my own freelance web dev company, I feel very comfortable saying that I would not take a project where I wasn't getting paid enough to bother hashing passwords. That's beyond justification. Either reject the client or protect their users.

Some sources now recommend argon2 over those two, could that be another right answer?

This should be part of the job, no matter how tight the budget is. Password hashing is quite accessible in almost every language and I can't think of any excuse not to hash passwords.

How much time does it take you to drop in bcrypt?

MD5 is a little better than plaintext. Difficult passwords are still difficult when you know their MD5 hash.

Base64... is actually plaintext; that's much, much worse.

Yeah MD5 is better to a degree, although 5f4dcc3b5aa765d61d8327deb882cf99 is still the most common password (md5 hashed) hehe :P

Right? You literally have to go OUT OF YOUR WAY to not be exposed to hasing/salting - every framework does it, most tutorials include it, for most environments its a simple library import/api.

I have to wonder how they sourced their developers. I don't think researchers would be motivated to do much more then post a low bidding ad on craigslist, meaning the quality of the developers will be commiserate.

It's inside the paper. They used Freelancer.com and gave 100EUR/200EUR to 100 developers. They created a fake company website and asked the devs to completed the sign-up portion of their fake social network because of one of their fake developers resigned recently.

They used 2 tier of payment to see if the payment had an effect on the security of the code.

> Final Study For the final study we recruited freelancers via direct messages. We searched for all freelancers and filtered for the skill “Java.” Unfortunately, Freelancer.com’s search function also returns JavaScript developers or developers where we saw no connection to Java, so we manually pruned out developers whose profile did not include Java skills. Based on our experience in the pre-studies we added two payment levels to our study design (EUR100 and EUR200). We only accepted freelancers’ submissions if they were functional