4 ms·

Omer here, one of the two guys behind this website. I'd like to thank the Hacker News community, who are in part the reason for our site's popularity. Thanks, e

• marshray 14y ago
  Since we have an interesting discussion going on, would you care to share a bit about the methodology? How do you determine by external observation that a site's password handling is sufficiently bad to merit the Plain Text Offender title?
  • omervk 14y ago
    It depends on the evidence the submitters send us. If it's a Forgot Password or Password Reminder (or sometimes being told what your password is by a CS rep), that's evidence enough. We also allow for Here Are Your Details emails after registration as evidence, though the probability is small that passwords are stored in plaintext/reversible encryption (but we still believe it's an offense since the password is both sent over an insecure medium and is stored on the email server).
    • glomph 14y ago
      Isn't there also the chance that they only send plain text at the time of storage? Would you still consider that a plain text offender?
      • omervk 14y ago
        Yes. We have talked about this in the past and all of the links are in the about page: http://plaintextoffenders.com/about http://plaintextoffenders.com/about