Re:LeakedIn
by jperras on Wednesday June 06, 2012 @03:30PM
(#4075687)
Again, you can check the source. It's a single page for a reason ;-). There's no trickery hidden in there.
[ Parent
| on HN ]
Maybe no trickery hidden in there now, but that could change any time.
Or sometimes. Or depending on IP, browser or OS.
And even if there's no "trickery" from the hosting site, they're slurping in javascript from a 3rd party down the bottom (getclicky). That means they (or anybody who compromises them) could grab the cleartext passwords from the form before the inline javascript does it's sha1 hashing…
I mean server-side (can we check the source for that?). The server could crack the hash, and the server could use various pieces of data (ip address, http headers, etc) to try to figure out more about the password's owner.
True, that's completely possible. However, if this concerns you then you should probably not sign up for any account on any site, since they could be doing the very same thing with your actual password.