Re:Ask HN: I see a popular website not hashing passwords
by irahul on Friday November 23, 2012 @05:36AM
(#4821748)
You do realise I said the same thing?
Re:Ask HN: I see a popular website not hashing passwords
by bernatfp on Sunday November 25, 2012 @06:39AM
(#4827919)
Do you realise the OP said the same thing?
Re:Ask HN: I see a popular website not hashing passwords
by irahul on Sunday November 25, 2012 @12:58PM
(#4828711)
"Hashing password is mandatory because user data can be compromised" is not the same as "Hashing passwords(preferably salted) come into picture only when user data is already compromised"
You sound like you may not be aware of how attacks happen in real life.
Most of the e-mail addresses that people sign up with are either yahoo or gmail. Most people are lazy and choose for this third-party site the same password from their yahoo or gmail accounts.
If the passwords are in plain text ... well ... then people's yahoo and gmail accounts are at risk.
Recently, yahoo notified me that someone has been trying to brute force my yahoo mail password. Luckily I use a different password on third party sites, but the thought of someone taking over my e-mail account was rather scary.