2 ms·

I haven't defended anywhere in my post stored passwords in plain text. Maybe you replied to the wrong post?

• jrockway 15y ago
  You mitigated its importance by saying: Unwarranted paranoia... Any time you set a password it travels in plain text (typically - and hopefully - via a secure connection) and it arrives to their server in plain text. This is true, but data in motion is less vulnerable to compromise than data at rest (due to how the Internet works and how web applications are programmed), and so the conclusion "unwarranted paranoia" is wrong. The paranoia is warranted.
  • muyuu 15y ago
    The main points from my point of view, and the reasons I think this is unwarranted paranoia: - not a critical resource : if your email is compromised, the importance of that makes this insignificant. It's also a local resource, cannot be exploited from afar. - just because they email it to you doesn't mean it's in plain text. It can be symmetrically encrypted, or (not in this case) it can be sent prior to storage. Not all accounts require draconian password policies. In fact, the abuse of these requirements encourage users to make really bad decisions regarding passwords, like reusing them or having them stored in a central repository.