How securely do they store user passwords & how good are they at letting us know?
@PasswordStorage • Rating guide
Disclosures:
Passwords stored in plaintext, in their original, readable form, or passwords encrypted instead of hashed.
Recommended change: Hash passwords using a “slow” hashing function, publish storage and hashing info visibly, then let me know.
Params: cost=10
cost=10
Full algorithm: AES-256-CBC(bcrypt(password))
AES-256-CBC(bcrypt(password))
A slow hashing function is used but such info is "invisible", hidden in a blog post or a talk, or on social media.
Recommended change: Publish storage and hashing info details visibly (e.g. in the docs or FAQ), then let me know.