4 ms·
By the way, while we are on this topic--can you confirm that passwords are not stored in plain-text?
by anewaccountname 19y ago
By the way, while we are on this topic--can you confirm that passwords are not stored in plain-text?
- pg 19y agoSure. You can see for yourself in the source: http://ycombinator.com/arc/arc1.tar http://ycombinator.com/arc/arc1.tar
- brett 19y agoOn disk at least. They're temporarily logged to memory in the clear: (def good-login (user pw ip) (let record (list (seconds) ip user pw) (if (and user pw (aand (shash pw) (is it (hpasswords* user)))) (do (unless (user->cookie* user) (cook-user user)) (enq-limit record good-logins*) user) (do (enq-limit record bad-logins*) nil)))) It might be good to pull the pw out of the record list: ... (let record (list (seconds) ip user) ...
- pg 19y agoOk, I took it out. Turns out nothing later ever needs the pw anyway.
- jsjenkins168 19y agoI hope you are not reusing an important password for this site.. Even if they are hashed on the disk, they are sent insecurely to the server when you log in.