omervk

I've been using crit since very early on and it's become an invaluable tool in my arsenal since day one. It really fills that niche of reviewing agent work easily and painlessly.

Thanks for building this and for being so attentive to feedback, Tomasz!

(part 1 of 3, with the other two linked from the post)

"Without blocking your users from using your app"

Almost every single example on there was blocking my view of the content in one way or another.

Please don't send passwords via email. http://plaintextoffenders.com/faq/devs

I've been influenced by jetlag more than once and I can say hands-down the most effective and least cumbersome method I've found is just to take a Melatonin pill and drowse off to sleep 10 minutes later. If I'm still feeling it, I'd take another one before going to sleep the next night.

Thanks for the feedback. I went back to the article (which we started linking to a couple of years ago) and saw the comments and, along with what you wrote here, removed the preference of scrypt and PBKDF2 over bcrypt.

I'd appreciate it if you could post this as a comment on the page itself. :)

Hey all, this is @omervk, one of the co-founders and maintainer of plaintextoffenders.com. I was thrilled when OP approached us with the initial version. I'm really looking forward to seeing what you guys can build on top of this :)

Good point.

That's a great idea! I'll add "I've been listed! What do I do?" to the FAQ. Thanks!

I thought of my mom and dad reading this and what they would best understand. I'm worried using something like "one-way encryption" would have their eyes glaze over :)

I'd appreciate it if you could post this as a comment to the Dev FAQ page :)

Yes, because you might not be the first to use that password.

Re: Q8. Security questions are an anti-pattern and the rest are outside our mandate. I do not claim to have written the penultimate guide to password security :)

Re: Q9. Again, that's a great pattern, but is not a requirement to not be on our list.

This is linked to from the non-dev FAQ, but I'll make sure to add a section about 2FA to the dev section.

Thanks!

Fixed. Thanks :)

Added. Thanks :)

Soon :)

I have. Please take a look at another comment that explains the issues with it here: https://news.ycombinator.com/item?id=7943695

Thanks, I used your number, too. :)

What would you suggest as a sane upper bound?

1. You're right. Fixed.

2. Rephrased.

Soon :)

Because then users would lose faith in your service? Also, your service can then be abused. Think about a hacker ramping up charges on a credit card, only to have fraud detection activated and you losing money (and getting worse rates in the process).

It's a good thought, but the FAQ starts with what we are, why and how to contribute.

What would you suggest?

That's a good point, but I think it goes a bit over what I was getting at.

Thanks, I've added wording for that.

Good idea. Implemented.

Hence our mentioning that the user must receive a mail notifying of the password change.