Pinterest hacked?

Re:Pinterest hacked? by amccloud on Saturday May 11, 2013 @02:35AM (#5689909)

Last time I checked, Pinterest is built on Django. They would explicitly need to go out of their way to store password insecurely.

Also, the fact that the form in your screenshot ask for csrf token and session id is very odd.

I'd argue that you found something that wasn't built by Pintest but instead someone's tool for controlling and managing multiple Pinterest accounts.

[ Parent | on HN ]

Re:Pinterest hacked? by est on Saturday May 11, 2013 @02:44AM (#5689934)

Django by default use salted bcrypt, why would anyone NOT doing that?

Adding a change password function to a custom model is too trivial

    class MyUser(models.Model):
      password = models.CharField(max_length=128)
      set_password = django.contrib.auth.models.User.set_password.__func__
      check_password = django.contrib.auth.models.User.check_password.__func__

And you can do with your instance with set_password() or check_password() like Django's admin User.

[ Parent | on HN ]