Robinhood Stored Passwords in Plaintext

Re:Robinhood Stored Passwords in Plaintext by rocqua on Wednesday July 24, 2019 @06:38PM (#20520731)

That introduces additional complexity, and the password is already protected by https.

As others have pointed out, if you go for complexity, there are better schemes. However, by avoiding the complexity you keep simpler client side code.

Especially because this is standard, whilst doing extra stuff would involve doing your own crypto code.

[ Parent | on HN ]

Re:Robinhood Stored Passwords in Plaintext by SlayAe on Thursday July 25, 2019 @02:33AM (#20523134)

The only thing that you nées is a hash fonction. I think thé added complexity ils negligible on any modern System.

[ Parent | on HN ]

Re:Robinhood Stored Passwords in Plaintext by cerberusss on Friday July 26, 2019 @01:43AM (#20532646)

Small tip: looking at the spelling errrors, I bet you're on mobile, and using the standard Google or iOS keyboard set to French. I constantly have to switch between English and my native language as well. But I found out that with Swiftkey (by Microsoft), you don't need to manually switch between two languages; you just configure two language at once and the software does autocorrect for both.

[ Parent | on HN ]

Re:Robinhood Stored Passwords in Plaintext by rocqua on Thursday July 25, 2019 @04:38PM (#20529434)

Complexity of the code base. The computation of hashes client side requires quite a bit of custom code. Sending a plain text password is build into the browser.

[ Parent | on HN ]