3 ms·
Stories like this come up every couple months. The true story should be titled Jerry Asher doesn't understand basic security. It's pretty worrisome that develop
by latch 15y ago
Stories like this come up every couple months. The true story should be titled Jerry Asher doesn't understand basic security. It's pretty worrisome that developers don't understand the difference between encryption and hashing, and then symmetric vs asymmetric key encryption.
Of course, Newegg should adopt a strong hash policy since they've introduced a single point of failure.
- latch 15y agoYou're defending your post pretty strongly, and you can downvote me all you want, but you specifically said "That must mean that Newegg stores your passwords in the clear, as plaintex" I didn't add the word must there.
- jerrya 15y agoI have not yet achieved or unlocked "downvote". :( I'm not sure I want to just get into rewriting a post, but I did update it to reference the discussion and I did mention the more correct (unlikely) theory that there is a two way encryption involved and everything is hunky-dory.
- kelnos 15y agoEven if there is 2-way encryption involved, I don't find that an acceptable means of password storage. If the original password is retrievable by anything other than painful (hopefully infeasible) brute-force means, it's bad.
- jerrya 15y agoI agree. Up above it was pointed out that it's bad because a) people use the same passwords across sites, and b) by not allowing peeking at a password, bad employees are forced to use mechanisms that are more likely to create audit trails, like mechanisms that change a password in the database.