How really to store passwords (and API tokens, which are passwords) | Hacker News Reader