undefined | Better HN

0 pointsnickmolnar216y ago0 comments

Don't worry. We aren't storing anything in plaintext. SHA-1 with a 256-bit salt.

Sorry, I was a little confused about the password-via-email comment. No, it doesn't shorten your reg. Only the share. We include the password for easy record-keeping for users. Also, we don't keep anything of value on JTB. It is just receipts. No bank account numbers or CC numbers. Just like a paper receipt.

0 comments

2 comments · 2 top-level

cliff16y ago

You're still sending the password I entered back to me in an email in plaintext, even if you're not keeping it.

This is considered horrible practice.

I was excited about your product until I received an email with my password in it.. it just killed my enthusiasm. At some point I'll look back, but for a site that stores financial data...kinda scary.

kylebragger16y ago

Awesome, thanks for the clarification.

j / k navigate · click thread line to collapse