Hacker News new | past | comments | ask | show | jobs | submit login

Since you seem off on the issue, it's quite possible to store a password as encrypted in the database and still be able to decrypt it.

I agree that MD5 isn't what they're using, as it isn't reversible encryption, or even encryption at all, but that ignores the fact that it's very possible to store a salted, encrypted password in a database, the salt on a separate file system, and still be able to send you your password in plain text.




For all intents and purposes, reversible encryption of passwords might as well be plain text.


Eh. There are ways to keep reversible encryption pretty secure, but while I agree with the notion, it makes a huge difference if the asshole on the other end of the phone keeps yelling about PLAIN TEXT passwords.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: