4 ms·

It's insane to me that it's not "common knowledge" to AT LEAST hash the passwords. It's also interesting because 6 used an encryption algorithm, 10 used MD5 wh

It's insane to me that it's not "common knowledge" to AT LEAST hash the passwords. It's also interesting because 6 used an encryption algorithm, 10 used MD5 which is as good as plaintext nowadays IMO, and 8 used Base64, so even though 24 people thought they "secured it" the passwords are trivial to recover.

thaumasiotes 8y ago
MD5 is a little better than plaintext. Difficult passwords are still difficult when you know their MD5 hash. Base64... is actually plaintext; that's much, much worse.
- penagwin 8y ago
  Yeah MD5 is better to a degree, although 5f4dcc3b5aa765d61d8327deb882cf99 is still the most common password (md5 hashed) hehe :P
ecesena 8y ago
To play devil’s advocate, to me plaintext means I want to finish quickly because you haven’t asked and are paying too little, while any solution other than bcrypt/pbkdf2 means I don’t know what I’m doing.
- woah 8y ago
  How much time does it take you to drop in bcrypt?
- blotter_paper 8y ago
  Having once run my own freelance web dev company, I feel very comfortable saying that I would not take a project where I wasn't getting paid enough to bother hashing passwords. That's beyond justification. Either reject the client or protect their users.
- Ayesh 8y ago
  This should be part of the job, no matter how tight the budget is. Password hashing is quite accessible in almost every language and I can't think of any excuse not to hash passwords.
- hn3000 8y ago
  Some sources now recommend argon2 over those two, could that be another right answer?
ben_jones 8y ago
Right? You literally have to go OUT OF YOUR WAY to not be exposed to hasing/salting - every framework does it, most tutorials include it, for most environments its a simple library import/api. I have to wonder how they sourced their developers. I don't think researchers would be motivated to do much more then post a low bidding ad on craigslist, meaning the quality of the developers will be commiserate.
- rnotaro 8y ago
  It's inside the paper. They used Freelancer.com and gave 100EUR/200EUR to 100 developers. They created a fake company website and asked the devs to completed the sign-up portion of their fake social network because of one of their fake developers resigned recently. They used 2 tier of payment to see if the payment had an effect on the security of the code. > Final Study For the final study we recruited freelancers via direct messages. We searched for all freelancers and filtered for the skill “Java.” Unfortunately, Freelancer.com’s search function also returns JavaScript developers or developers where we saw no connection to Java, so we manually pruned out developers whose profile did not include Java skills. Based on our experience in the pre-studies we added two payment levels to our study design (EUR100 and EUR200). We only accepted freelancers’ submissions if they were functional

thaumasiotes 8y ago

MD5 is a little better than plaintext. Difficult passwords are still difficult when you know their MD5 hash. Base64... is actually plaintext; that's much, much worse.

penagwin 8y ago
Yeah MD5 is better to a degree, although 5f4dcc3b5aa765d61d8327deb882cf99 is still the most common password (md5 hashed) hehe :P

ecesena 8y ago

To play devil’s advocate, to me plaintext means I want to finish quickly because you haven’t asked and are paying too little, while any solution other than bcrypt/pbkdf2 means I don’t know what I’m doing.

woah 8y ago
How much time does it take you to drop in bcrypt?
blotter_paper 8y ago
Having once run my own freelance web dev company, I feel very comfortable saying that I would not take a project where I wasn't getting paid enough to bother hashing passwords. That's beyond justification. Either reject the client or protect their users.
Ayesh 8y ago
This should be part of the job, no matter how tight the budget is. Password hashing is quite accessible in almost every language and I can't think of any excuse not to hash passwords.
hn3000 8y ago
Some sources now recommend argon2 over those two, could that be another right answer?

ben_jones 8y ago

Right? You literally have to go OUT OF YOUR WAY to not be exposed to hasing/salting - every framework does it, most tutorials include it, for most environments its a simple library import/api. I have to wonder how they sourced their developers. I don't think researchers would be motivated to do much more then post a low bidding ad on craigslist, meaning the quality of the developers will be commiserate.

rnotaro 8y ago
It's inside the paper. They used Freelancer.com and gave 100EUR/200EUR to 100 developers. They created a fake company website and asked the devs to completed the sign-up portion of their fake social network because of one of their fake developers resigned recently. They used 2 tier of payment to see if the payment had an effect on the security of the code. > Final Study For the final study we recruited freelancers via direct messages. We searched for all freelancers and filtered for the skill “Java.” Unfortunately, Freelancer.com’s search function also returns JavaScript developers or developers where we saw no connection to Java, so we manually pruned out developers whose profile did not include Java skills. Based on our experience in the pre-studies we added two payment levels to our study design (EUR100 and EUR200). We only accepted freelancers’ submissions if they were functional