News for hackers. Stuff that matters.

A comment on How Not to Do Web Site User Registration. Parent comment

Re:How Not to Do Web Site User Registration by pj on Wednesday May 27, 2009 @01:57PM (#628840)
If you look at the actual WP create account page here: http://en.wordpress.com/signup/

You'll see that there is a box for your password and a confirmation of the password, so that leads me to believe that they are actually sending the user the password they created the account with, rather than a randomly generated one. Otherwise, why have the input fields there at all?

Therefore, they must be storing either plain text or two-way encryption.

[ Parent | on HN ]
Re:How Not to Do Web Site User Registration by TallGuyShort on Wednesday May 27, 2009 @02:04PM (#628854)
Which also suggests that these are passwords that most users use for other online accounts...
[ Parent | on HN ]