Yeah exactly, but for this particular usecase the "token based login" seems to be the best tradeoff between complexity and requirements. They seem to have put

Yeah exactly, but for this particular usecase the "token based login" seems to be the best tradeoff between complexity and requirements. They seem to have put the effort elsewhere, e.g. keeping their system devoid of billing and credit card info. Something a lot of shops that salt and do multi round scrypt hashing probably don't, because even though they do follow best practices, they don't actually think about security. Would I have built it with hashing and automatic keygen on reset? sure! But this thing seems good enough tm. Security isn't something where one solution fits all, otherwise everything thats low stakes like this (homework, guitar notes collection, my dogs homepage) gets the same security best practices as the hight stakes stuff (medical, financial, social). I'd rather have this hacked together in php, but my bank run idris code, and my kitchen robot run haskell, than everything using node with scrypt hashed JWT.