How Not to Do Web Site User Registration

Re:How Not to Do Web Site User Registration by trickjarrett on Wednesday May 27, 2009 @01:27PM (#628773)

I highly doubt Wordpress.com is storing the passwords in a reversible encryption, or in plain text. It seems to me that when the user hits that page, the password is generated and displayed.

Yes it should be https at the least, but aren't you going to go in and change the password immediately anyways?

[ Parent | on HN ]

Re:How Not to Do Web Site User Registration by pj on Wednesday May 27, 2009 @01:57PM (#628840)

If you look at the actual WP create account page here: http://en.wordpress.com/signup/

You'll see that there is a box for your password and a confirmation of the password, so that leads me to believe that they are actually sending the user the password they created the account with, rather than a randomly generated one. Otherwise, why have the input fields there at all?

Therefore, they must be storing either plain text or two-way encryption.

[ Parent | on HN ]

Re:How Not to Do Web Site User Registration by TallGuyShort on Wednesday May 27, 2009 @02:04PM (#628854)

Which also suggests that these are passwords that most users use for other online accounts...

[ Parent | on HN ]

Re:How Not to Do Web Site User Registration by wysiwtf on Wednesday May 27, 2009 @01:35PM (#628795)

I agree, the main issue here is that they're not using SSL during these steps, and the second is that they don't recommend changing your password from the generated default.

[ Parent | on HN ]