one time someone sent in a very concerned bug report that we were storing their password in plain text1 because when they went to change their password it was displayed in plain text in the box, but also it wasn't displayed correctly, it was showing something that wasn't their password (hunter2, someone else's password maybe????) and also this was bad security and they want to delete their account immediately.
i think i ascended to a higher plane of existence when i read this. it was wild stuff. big "starbucks customer tells barista they got their order wrong, when the reality is they grabbed the order for a completely different person, with a different name, and then decided this was the barista's fault somehow" energy. what's the website equivalent of ordering a tiktok drink with forty different syrups in it
-
we're not; fun fact your password isn't even sent over the wire (we do some initial hashing on the client, send that, then do some More hashing on the server. your password never goes anywhere.)
