That's because of the HN security. It prints all passwords as stars.

You can try putting your HN password in a comment, it would be visible only by you, and the others will not see it.

I guess you're right. My HN password is *****.

When I edit, I can see it, but when I save the comment, it becomes starred. It even randomizes the length every time I save.

Brilliant!

But this also means that they know your plaintext password, meaning that they're saving passwords in plaintext. Given that this is mostly a technical community, it's much more the risk of keeping a database of plaintext passwords than the benefit of being able to obfuscate passwords in comments.

EDIT: thanks to another commenter, I understood that what's happening in the above comments is just a meme and HN isn't storing plaintext passwords. Sorry for the misunderstanding.

In case you're unclear why your being down voted, comment chain is a riff on one of the more famous bash.org quotes: https://knowyourmeme.com/memes/hunter2.

HN does not actually know your password or hide it in comments.

> HN does not actually know your password or hide it in comments.

Does it not know? What if I post it in this comment? My password is *****.

(whistles softly as he changes password from a string of twelve asterisks to ******)

(sticking with the obliviousness for a moment,) Would they need to store the plaintext password? Hashing every word typed isn't efficient but it's possible to achieve without knowing the plaintext.

It reminds me of Facebook allowing login even when you've mistyped your password: https://security.stackexchange.com/questions/214814/why-can-...

Yes, that's true. But since HN is famously hosted on a single not-so-powerful server, that would be unlikely to be the employed solution.

Considering how laggy the comment box is on reddit, it makes me wonder if they're not already doing something similar, but client-side in js. I guess it would expose the salt though.

Exposing the salt isn't an issue, it can (and should) even be a different one for each account.

> Hashing every word typed

Wouldn’t work if your password contains spaces.

They just hash every substring that can be a password.

Don't write long comments. Show some love to HN's server carrying its O(n^2) burden.

But it does! They, instead, hash each letter independently, that's how they can do this.

What actually happens is more complex: when you type a *******, HN tries to log in once for every string in your *******, and then when it succeeds it goes back and replaces that string with a randomized length of asterisks.

I love that some 20-30 years after that famous chat somebody still fell for it.

*****? That's amazing! I've got the same password on my luggage!

How about ****** Did it work?

Oh wow, you kiss your mother with that mouth?

I use my fingers to type passwords and ehh...

hunter1

Close.

hunter2

Wait, how did you see my password?

we see it as asterisks ... you see it as hunter2 and not **** 'cos it's your password

What? I just see stars

Get to a doctor!

What? I just see stars

Have you seen a doctor?

No, just stars

Ready when you are, Raul.

This has to be a joke.

The only way it can be realistically implemented involves the storage of clear-text user password to enable string replacement during comment submission. Either that or converting user comment to a prefix/suffix table (or something similar) and then hash each item to search for a match. Both option is ridiculously unnecessary.

Anyway, my HN password is ****. I bet it don't work.

Fortunately with modern serverless architecture, it's possible to make this performant! Just split up each comment into words and dispatch each word to a queue where AWS Lambda workers can check the words against the user's password hash. It might cost $20 to process each comment, but at least it'll autoscale to handle any comment volume you throw at it!

Can passwords include spaces?