Hacker News Reader

I'm mystified when articles like this come out. Even new developers know not to store passwords in plain text. Popular web frameworks like Laravel have password hashing built-in, preventing even bad developers from making this mistake. I cannot even conceive of how a such an insecure system gets built. Can we simply assume that this behaviour is intentional (and, perhaps, even devious)? Or is there some logical explanation for such poor design?

View on HN

Sorry but this type of issue often occur because developers has your mindset. I've had so many auditors and security reviewers ask me "how do you hash your password?" but no one has asked me if I log http request, session tokens, outbound emails or any other thing where sensitive data can be transmitted. Nor have they asked me what the actual process for rotating credentials when employees leave, more than "Do you do it?"

I see, thank you, I wrongly assumed they were just looking at the database.

I recently used a website to sign up for online Health insurance access and noticed they console.log your password back to you in clear text whenever you hit submit. Now maybe 99% of the population won't know what to do with that, but despite the fact that someone's debug log for passwords made it into production which tells me all I need to know about their standards, what if they are using something like rollbar, fullstory, or god knows what else that captures log output? What about malicious browser extensions? I called their technical support helpline, and I got the typical joke of a "oh that's not my department" response. Imagine what they are doing with our healthcare data.

Reply on news.ycombinator.com