WTF? I got the email from HipChat. It includes this sentence. Without additional non-techy context
"HipChat hashes passwords using bcrypt with a random salt."
This is a good example of how not to do mass e-mails targeting the general population.
"HipChat hashes passwords using bcrypt with a random salt."
This is a good example of how not to do mass e-mails targeting the general population.
If they'd explained both ways, somebody would accuse them of the notification being too long as part of a scheme to bury the details below the fold.
As a company reporting an issue, no matter what you do, the internet's gonna nit pick
I'm happy they say this.. now i'd like some sort of proof :-)
Poor UX is my point of this
blah blah...We take your privacy very seriously...blah blah...
[1] Technically, we use bcrypt with a random salt.
Security is hard. Describing security is even harder.
I'm for transparency in security for review, but you can achieve the same via a 3rd party audit.
Just my 2c.