4 ms·

WTF? I got the email from HipChat. It includes this sentence. Without additional non-techy context "HipChat hashes passwords using bcrypt with a random salt."

WTF? I got the email from HipChat. It includes this sentence. Without additional non-techy context "HipChat hashes passwords using bcrypt with a random salt." This is a good example of how not to do mass e-mails targeting the general population.

balls187 10y ago
Serious question: Do you need the non-techy explanation?
- jordache 10y ago
  no.. but I could be a non IT user using hipchat. This sentence is likely meaningless to me.
  - balls187 10y ago
    Sure. I get your point. Just asking if YOU specifically needed the explanation, which I'm sure a number of folks would be happy to provide.
  - plange 10y ago
    Then you would be fine with the standard boilerplate "your data is secure with us"? I'm happy they say this.. now i'd like some sort of proof :-)
    - jordache 10y ago
      A follow up sentence that re-iterates the same sentiment in non technical term will accommodate none technical recipients. Poor UX is my point of this
  - bjoernw 10y ago
    Googling bcrypt should do the trick and most people know how to do that. </sarcasm>
    - jordache 10y ago
      you're joking I assume. If not, don't be in the UX field
    - deleted 10y ago
      [deleted]
  - detaro 10y ago
    Is that a problem? I guess they could have put a "technical details:" in front of it, to make that clearer, but it has to be in that e-mail (otherwise the techies complain) and isn't really something they can explain in a useful way there.
  - ams6110 10y ago
    Better would be "We securely[1] store your passwords" blah blah...We take your privacy very seriously...blah blah... [1] Technically, we use bcrypt with a random salt.
  - balls187 10y ago
    An argument could be made to take this a step further and not even go into buzzword details at all, and leave it with boilerplate words. Security is hard. Describing security is even harder. I'm for transparency in security for review, but you can achieve the same via a 3rd party audit. Just my 2c.
akerl_ 10y ago
If they'd just said "We securely store your passwords", they would have tech people with pitchforks and torches about how they need to name their password hashing algorithm. If they'd explained both ways, somebody would accuse them of the notification being too long as part of a scheme to bury the details below the fold. As a company reporting an issue, no matter what you do, the internet's gonna nit pick
- deleted 10y ago
  [deleted]

balls187 10y ago

Serious question: Do you need the non-techy explanation?

jordache 10y ago
no.. but I could be a non IT user using hipchat. This sentence is likely meaningless to me.
- balls187 10y ago
  Sure. I get your point. Just asking if YOU specifically needed the explanation, which I'm sure a number of folks would be happy to provide.
- plange 10y ago
  Then you would be fine with the standard boilerplate "your data is secure with us"? I'm happy they say this.. now i'd like some sort of proof :-)
  - jordache 10y ago
    A follow up sentence that re-iterates the same sentiment in non technical term will accommodate none technical recipients. Poor UX is my point of this
- bjoernw 10y ago
  Googling bcrypt should do the trick and most people know how to do that. </sarcasm>
  - jordache 10y ago
    you're joking I assume. If not, don't be in the UX field
  - deleted 10y ago
    [deleted]
- detaro 10y ago
  Is that a problem? I guess they could have put a "technical details:" in front of it, to make that clearer, but it has to be in that e-mail (otherwise the techies complain) and isn't really something they can explain in a useful way there.
- ams6110 10y ago
  Better would be "We securely[1] store your passwords" blah blah...We take your privacy very seriously...blah blah... [1] Technically, we use bcrypt with a random salt.
- balls187 10y ago
  An argument could be made to take this a step further and not even go into buzzword details at all, and leave it with boilerplate words. Security is hard. Describing security is even harder. I'm for transparency in security for review, but you can achieve the same via a 3rd party audit. Just my 2c.

akerl_ 10y ago

If they'd just said "We securely store your passwords", they would have tech people with pitchforks and torches about how they need to name their password hashing algorithm. If they'd explained both ways, somebody would accuse them of the notification being too long as part of a scheme to bury the details below the fold. As a company reporting an issue, no matter what you do, the internet's gonna nit pick

deleted 10y ago
[deleted]