5 ms·
Pof has to store passwords in plaintext, sine they include it intentionally in a weekly email reminding you to login.. Yes. I know. At any rate, anyone who has
by andrewvc 16y ago
Pof has to store passwords in plaintext, sine they include it intentionally in a weekly email reminding you to login.. Yes. I know.
At any rate, anyone who has actually used pof can tell its been hacked together by substandard developers. No polish, a bizarre ui, and just general weirdness. This is the kind of shodiness I'd expect.
- narcissus 16y agoYou can encrypt a password in the database and still keep it retrievable (for things like this). Storing it in plain text, however, is inexcusable.
- wahnfrieden 16y agoStoring passwords using reversible encryption is not much better than plaintext.
- btilly 16y agoNot much better is still better. And it can be significantly better. In a past situation I stored sensitive information using public/private keys. Even if you got complete access to the webservers and database, you still could not decrypt that information. It would only be useful if you had access to the private key, which was much more securely controlled.
- andrewvc 16y agoIirc okcupid would let you login with one click via email via a token. I'm fairly sure they stopped doing this a while ago. A much better solution, with a better experience as well. Neither way is ideal, but making it easier to login probably helps viral growth.
- btilly 16y agoAt any rate, anyone who has actually used pof can tell its been hacked together by substandard developers. Developer, not developers. It started as a part time side project, and until 2007 Marcus Frind was the sole employee.
- rhizome 16y ago2007 is over three years ago.
- ericd 16y agoRunning a site as large as plenty of fish solo likely doesn't leave one with a ton of time for new development, unless he completely ignores customer service emails.
- rhizome 16y agoThe grandparent is saying that POF should be considered to have been written by one developer, because that's what it was until 2007.
- quellhorst 16y agoNo they don't have to. They can email users a link with an embedded hash that automatically logs them in. These links can expire. This is similar to how an email password reset works.
- alexyim 16y agoBut the user could've still forgotten it though..
- deleted 16y ago[deleted]
- kencausey 16y agoThe system quellhorst describes does not require the user to know the password, or even their own username. They click the link in the email and they are automatically logged in; it's an alternate authentication scheme. If they have lost their password that's a separate issue that should be handled separately but similarly by emailing them a link, again with an 'embedded hash', that allows them to reset their password. The assumption of course is that they and only they can access the email address specified in their account profile. If that's not the case then this all becomes a bit more problematic.
- andrewvc 16y agoYeah, I agree it's unbelievable stupid. that was meant as a tongue in cheek statement, hence the 'yeah, I know' at the end. OKCupid used to use tokens fwiw.