4 ms·
> A well-behaved app can have your password and do no harm. Until someone steals its database. You hash your user's passwords, right? Same thing - whether you
by bct 15y ago
> A well-behaved app can have your password and do no harm.
Until someone steals its database.
You hash your user's passwords, right? Same thing - whether you're talking about your app's passwords, or some 3rd party app's passwords, keeping them around in plain text is a bad idea.
- chrisrhoden 15y agoAnd hashing them is not useful if you intend to authenticate with them. I think you mean encrypt. Hacker finds encryption key. See "Until someone steals its database."
- bct 15y agoNo, that's not what I meant. It's an analogy - if sites shouldn't store their own passwords in plaintext or reversibly encrypted (which everyone here agrees on - "use BCrypt", etc), then they shouldn't store other passwords in plaintext or reversibly encrypted. They should use something like OAuth instead.
- chrisrhoden 15y agoMy bad, we agree on this. But there are a whole bunch of other great things that OAuth brings.
- bct 15y agoI must not have been very clear, because I'm being pro-OAuth here :)