<story><title>WeChat permanently closes account after user sets offensive password</title><url>https://twitter.com/BethanyAllenEbr/status/1268611608672194560</url></story><parent_chain><item><author>jialutu</author><text>Wow, it&amp;#x27;s quite disheartening to read some of the comments here. Let&amp;#x27;s try something shall we:&lt;p&gt;- open up private browsing&lt;p&gt;- press F12 (or however you get the developer console on a mac) and go to the networking tab&lt;p&gt;- go to gmail.com say&lt;p&gt;- enter your gmail credentials&lt;p&gt;- look at the post request generated, and at the request tab, it will contain your password in plain text&lt;p&gt;So passwords don&amp;#x27;t get hashed on transit, this is why having HTTPS is so crucial, which is to prevent someone in the middle (say when you connect to an open Starbucks wifi) from sniffing out your unencrypted password. The password on the server side initially can be unencrypted before it gets hashed to be stored into the database. So in this instance, the password in the database is hashed, but there is a small period where the password is plain text in memory.&lt;p&gt;For a site called hacker news, it&amp;#x27;s really sad how little people here know about hacking.</text></item></parent_chain><comment><author>masonhensley</author><text>I had a junior QA discover this while working at a Fortune 50... everything ground to a halt for two days until everyone (team of 20) was assured during a handful of meetings that this is how browsers work and why we use HTTPS.&lt;p&gt;I appreciate they where trying to protect passwords &amp;amp; promote security, but it definitely caught me off guard that this wasn&amp;#x27;t widely understood.</text></comment>
<story><title>WeChat permanently closes account after user sets offensive password</title><url>https://twitter.com/BethanyAllenEbr/status/1268611608672194560</url></story><parent_chain><item><author>jialutu</author><text>Wow, it&amp;#x27;s quite disheartening to read some of the comments here. Let&amp;#x27;s try something shall we:&lt;p&gt;- open up private browsing&lt;p&gt;- press F12 (or however you get the developer console on a mac) and go to the networking tab&lt;p&gt;- go to gmail.com say&lt;p&gt;- enter your gmail credentials&lt;p&gt;- look at the post request generated, and at the request tab, it will contain your password in plain text&lt;p&gt;So passwords don&amp;#x27;t get hashed on transit, this is why having HTTPS is so crucial, which is to prevent someone in the middle (say when you connect to an open Starbucks wifi) from sniffing out your unencrypted password. The password on the server side initially can be unencrypted before it gets hashed to be stored into the database. So in this instance, the password in the database is hashed, but there is a small period where the password is plain text in memory.&lt;p&gt;For a site called hacker news, it&amp;#x27;s really sad how little people here know about hacking.</text></item></parent_chain><comment><author>eddieplan9</author><text>Of course it’s OK the authentication system can read the password! What is so wrong on both technical and ethical levels is that the password entered into some data pipeline for machine learning. God knows what else they do with the cleartext passwords.</text></comment>