davidsong

Please excuse my ignorance, but why would you use carbon paper and store the copy rather than the original?

As someone who works for a bank I can say with some confidence that the only thing protecting your funds is the fact that transactions are reversable and insured.

I would not trust a bank with my bitcoins.

Maybe the three of them working on it want 64k each because they like round numbers.

The worry isn't unfounded though and in the case of programming it has actually been measured, the decline in quality of CS students is what inspired the Raspberry Pi project:

http://www.raspberrypi.org/about

It's a good idea IMO, I don't understand why it gets so much flak. A server who doesn't want to know your secret is more trustworthy than one that does, a MITM might be able to hijack your account but he won't see your favourite password and you don't have to trust that the server is hashing the password at their end.

To avoid the "hash is a plaintext password" problem you save double-hashed passwords to your database, once in the browser and once on the back-end, twice on the back-end if JavaScript was disabled in your user-agent.

Of course that doesn't solve the problem above, but it still ought to be common practice.