3 ms·
ciphertext + key = plaintext I will agree with you, however, that this site is being a bit sloppy with its claims and I am going along with it because it suits
by marshray 14y ago
ciphertext + key = plaintext
I will agree with you, however, that this site is being a bit sloppy with its claims and I am going along with it because it suits my purposes (i.e., errs on the side of being conservative). But this is how security needs to work. Those claiming a system is secure should usually end up with a healthy burden of proof, whereas those claiming it's probably not should be listened to carefully.
- laurent123456 14y agoBy being vague about their claims, they are also being unclear on what should be done to fix the issue. Maybe in some cases, the offending websites even feel they don't need to do anything. I can already imagine some reactions: - "I'm not storing the password in plain text, I'm hashing it after sending the email confirmation" - "I'm not storing it in plain text, I'm encrypting it." And of course, they would entirely miss the point that the real issue is that they are sending the password by email.
- marshray 14y agoIn other contexts of society it's perfectly reasonable (if not expected) to point out "offenders" (those who are increasing risk of harm to the public) without being obligated to at the same time to educate and reform the offender.