Tuts+ accounts hacked - User passwords stored in CLEARTEXT
notes.envato.com
Tuts+ accounts hacked - User passwords stored in CLEARTEXT
1–8 of 8 posts
Re: Tuts+ accounts hacked - User passwords stored in CLEARTEXT
#2What is Tuts+ about?
Re: Tuts+ accounts hacked - User passwords stored in CLEARTEXT
#3They knew the "plugin" stores passwords in clear text and still chose to use it.
I don't care if they had a plan to move away from it. That's not good enough.
Seriously how fucking hard is it to do things properly?
Re: Tuts+ accounts hacked - User passwords stored in CLEARTEXT
#4What is Tuts+ about?
Subscription-based Web/Photoshop/Illustrator/AV tutorials.
Re: Tuts+ accounts hacked - User passwords stored in CLEARTEXT
#5They knew the "plugin" stores passwords in clear text and still chose to use it. I don't care if they had a plan to move away from it. That's not good enough. Seriously how fucking hard is it to do things properly?
Clearly, this was a disaster waiting to happen. Not that it would ever happen, but if websites were required to disclose how sensitive information was stored, I'd guess this sort of intrusion would be far less common, since no one would use a site that left passwords unencrypted/salted/hashed. Tuts+ is a HUGE service... 660 on Alexa today. I am beyond frustrated.
Makes a big case for OAuth in my mind.
Re: Tuts+ accounts hacked - User passwords stored in CLEARTEXT
#6They knew the "plugin" stores passwords in clear text and still chose to use it. I don't care if they had a plan to move away from it. That's not good enough. Seriously how fucking hard is it to do things properly?
Clearly, this was a disaster waiting to happen. Not that it would ever happen, but if websites were required to disclose how sensitive information was stored, I'd guess this sort of intrusion would be far less common, since no one would use a site that left passwords unencrypted/salted/hashed. Tuts+ is a HUGE service... 660 on Alexa today. I am beyond frustrated. Makes a big case for OAuth in my mind.
I wish you were right, but check out the comments on the original article. Plenty of people whose response is "these things happen, good luck guys"
Plenty of developers have no fuckin clue about basic security, so why would users of a tutorial site?
Re: Tuts+ accounts hacked - User passwords stored in CLEARTEXT
#7What is Tuts+ about?
Passwords in clear text.
What was Tuts+ about.
Re: Tuts+ accounts hacked - User passwords stored in CLEARTEXT
#8the irony.