4 ms·
They didn't lose them, someone just noticed that they would send you your original password if you requested it and made a blog post about it. The conclusion w
by qeorge 17y ago
They didn't lose them, someone just noticed that they would send you your original password if you requested it and made a blog post about it.
The conclusion was that they must be storing passwords plaintext, although that's not necessarily true. IIRC, your opinion was that this was not a big deal in the grand scheme of things.
- tptacek 17y agoI said it wasn't a vulnerability, or, if it was, it was a minor one compared to a real vulnerability; sev:low compared to sev:medium for a stored XSS flaw and sev:high for SQL Injection. And I believe that. But if we're comparing one password storage mechanism to another, I get religious fast. There's a right and a wrong way to do it. 37s did it the wrong way. Now I understand they do it the right way. Good for them!
- qeorge 17y agoYeah, I remember that better now. There were a lot of pitchforks that day. 37s has a great track record of listening to and acting on community feedback, which is all you can really ask for. I second your kudos.