<story><title>Can you trust 37signals with your password? </title><url>http://www.jgc.org/blog/2009/05/can-you-trust-37signals-with-your.html</url><text></text></story><parent_chain><item><author>tptacek</author><text>&quot;Embarassing security flaw&quot;? Come on. We audit several major web applications every week --- things that are far more sensitive than 37s, like banking, trading, and pension --- and we see sites store plaintext passwords all the time. I&apos;ve never seen any vendor&apos;s security report write someone up for this. If it did get written up, it&apos;d be &quot;Severity: Low&quot;, along with &quot;enabling weak SSL ciphers&quot; and &quot;exposed server version information&quot;.&lt;p&gt;I&apos;m not trying to be an apologist here, but &quot;someone is wrong on the Internet&quot; if they are saying that storing passwords badly is a major vulnerability.</text></item><item><author>ryanwaggoner</author><text>What&apos;s worse is that they&apos;ve known that it&apos;s an embarrassing security flaw for years, but they apparently thought other things were more important.  Not really very comforting.</text></item><item><author>mpk</author><text>Oh boy, that&apos;s an embarrassing newbie mistake to make.</text></item></parent_chain><comment><author>thorax</author><text>I didn&apos;t expect to see a downplaying comment from you after your strong stances in this thread and your article:&lt;p&gt;&lt;a href=&quot;http://news.ycombinator.com/item?id=576021&quot; rel=&quot;nofollow&quot;&gt;http://news.ycombinator.com/item?id=576021&lt;/a&gt;&lt;p&gt;Is it a big deal to properly store the passwords or isn&apos;t it?&lt;p&gt;&amp;#62; &lt;i&gt;stop working on your social shopping cart calendar application right now: I can’t trust you with my Reddit karma score, let alone my credit card number.&lt;/i&gt;&lt;p&gt;and that&apos;s what you said for developers using fast 1-way hashes. So it&apos;s embarrassing to use md5+salt, but not embarrassing to use plaintext?&lt;p&gt;The method we use for storing passwords is either vital or it&apos;s not-- I&apos;m currently lost as to how you could respond like the above and have such strong feelings about the matter in other discussions.</text></comment>
<story><title>Can you trust 37signals with your password? </title><url>http://www.jgc.org/blog/2009/05/can-you-trust-37signals-with-your.html</url><text></text></story><parent_chain><item><author>tptacek</author><text>&quot;Embarassing security flaw&quot;? Come on. We audit several major web applications every week --- things that are far more sensitive than 37s, like banking, trading, and pension --- and we see sites store plaintext passwords all the time. I&apos;ve never seen any vendor&apos;s security report write someone up for this. If it did get written up, it&apos;d be &quot;Severity: Low&quot;, along with &quot;enabling weak SSL ciphers&quot; and &quot;exposed server version information&quot;.&lt;p&gt;I&apos;m not trying to be an apologist here, but &quot;someone is wrong on the Internet&quot; if they are saying that storing passwords badly is a major vulnerability.</text></item><item><author>ryanwaggoner</author><text>What&apos;s worse is that they&apos;ve known that it&apos;s an embarrassing security flaw for years, but they apparently thought other things were more important.  Not really very comforting.</text></item><item><author>mpk</author><text>Oh boy, that&apos;s an embarrassing newbie mistake to make.</text></item></parent_chain><comment><author>cperciva</author><text>The fact that this is a common mistake doesn&apos;t make it any less serious.  I don&apos;t do security audits, but if I did I would certainly point out this sort of mistake -- because even if it doesn&apos;t affect &lt;i&gt;this site&apos;s&lt;/i&gt; security very much, it certainly has an impact on &lt;i&gt;their customers&apos;&lt;/i&gt; security thanks to the reuse of passwords.</text></comment>