3 ms·
You can encrypt a password in the database and still keep it retrievable (for things like this). Storing it in plain text, however, is inexcusable.
by narcissus 16y ago
You can encrypt a password in the database and still keep it retrievable (for things like this). Storing it in plain text, however, is inexcusable.
- wahnfrieden 16y agoStoring passwords using reversible encryption is not much better than plaintext.
- btilly 16y agoNot much better is still better. And it can be significantly better. In a past situation I stored sensitive information using public/private keys. Even if you got complete access to the webservers and database, you still could not decrypt that information. It would only be useful if you had access to the private key, which was much more securely controlled.
- andrewvc 16y agoIirc okcupid would let you login with one click via email via a token. I'm fairly sure they stopped doing this a while ago. A much better solution, with a better experience as well. Neither way is ideal, but making it easier to login probably helps viral growth.