4 ms·

"Agile Web Development With Rails", Chapter 11, Administration

• tsally 17y ago
  Here's the sample code they give in that chapter: def self.encrypted_password(password, salt) string_to_hash = password + "wibble" + salt # 'wibble' makes it harder to guess Digest::SHA1.hexdigest(string_to_hash) end They are using SHA1 with a salt, the exact method that security experts recommend against when storing passwords: http://news.ycombinator.com/item?id=995645 http://news.ycombinator.com/item?id=995645. And obviously they didn't even use this insecure method internally. EDIT: tptacek makes a good point. I haven't quite been fair. 37signals did what most companies never do when confronted with a security issue: they quickly acknowledged the problem, fixed it based on the suggestions of the security researchers, and moved on.
  • tptacek 17y ago
    You're right. Just give them credit for taking their lumps, apologizing, and getting religion.