News for hackers. Stuff that matters.

A comment on How I Lost My $50,000 Twitter Username. Parent comment

Re:How I Lost My $50,000 Twitter Username by redblacktree on Wednesday January 29, 2014 @10:43AM (#7144469)
It does mean that passwords aren't properly hashed. They may be encrypted, but that still leaves open the possibility for an engineer or attacker to have access to plain text passwords.
[ Parent | on HN ]
Re:How I Lost My $50,000 Twitter Username by arjie on Wednesday January 29, 2014 @11:46AM (#7144981)
No, it does not. You can receive the password, email it to creator, hash it, and then store it. It's not ideal because you now expose it in plaintext in the original email, but you aren't storing plaintext.
[ Parent | on HN ]
Re:How I Lost My $50,000 Twitter Username by redblacktree on Thursday January 30, 2014 @11:36AM (#7151549)
You're right. I missed the "when they create their account" part.
[ Parent | on HN ]
Re:How I Lost My $50,000 Twitter Username by gog on Wednesday January 29, 2014 @11:50AM (#7145016)
No it doesn't, the registration email can be sent before the password is hashed.
[ Parent | on HN ]