4 ms·
But this also means that they know your plaintext password, meaning that they're saving passwords in plaintext. Given that this is mostly a technical community,
by GTP 3y ago
But this also means that they know your plaintext password, meaning that they're saving passwords in plaintext. Given that this is mostly a technical community, it's much more the risk of keeping a database of plaintext passwords than the benefit of being able to obfuscate passwords in comments.
EDIT: thanks to another commenter, I understood that what's happening in the above comments is just a meme and HN isn't storing plaintext passwords. Sorry for the misunderstanding.
- Volundr 3y agoIn case you're unclear why your being down voted, comment chain is a riff on one of the more famous bash.org quotes: https://knowyourmeme.com/memes/hunter2 https://knowyourmeme.com/memes/hunter2. HN does not actually know your password or hide it in comments.
- Duanemclemore 3y ago(whistles softly as he changes password from a string of twelve asterisks to ******)
- mewpmewp2 3y ago> HN does not actually know your password or hide it in comments. Does it not know? What if I post it in this comment? My password is *****.
- svnt 3y agoWhat actually happens is more complex: when you type a *******, HN tries to log in once for every string in your *******, and then when it succeeds it goes back and replaces that string with a randomized length of asterisks.
- BuildTheRobots 3y ago(sticking with the obliviousness for a moment,) Would they need to store the plaintext password? Hashing every word typed isn't efficient but it's possible to achieve without knowing the plaintext. It reminds me of Facebook allowing login even when you've mistyped your password: https://security.stackexchange.com/questions/214814/why-can-i-log-in-to-my-facebook-account-with-a-misspelled-email-password https://security.stackexchange.com/questions/214814/why-can-...
- GTP 3y agoYes, that's true. But since HN is famously hosted on a single not-so-powerful server, that would be unlikely to be the employed solution.
- BuildTheRobots 3y agoConsidering how laggy the comment box is on reddit, it makes me wonder if they're not already doing something similar, but client-side in js. I guess it would expose the salt though.
- GTP 3y agoExposing the salt isn't an issue, it can (and should) even be a different one for each account.
- latexr 3y ago> Hashing every word typed Wouldn’t work if your password contains spaces.
- b112 3y agoBut it does! They, instead, hash each letter independently, that's how they can do this.
- KETHERCORTEX 3y agoThey just hash every substring that can be a password. Don't write long comments. Show some love to HN's server carrying its O(n^2) burden.
- Tainnor 3y agoI love that some 20-30 years after that famous chat somebody still fell for it.