Hack of Cupid Media dating website exposes 42 million plaintext passwords
Before the bcryot/scrypt advocacy and general shaming starts... I'll just make the same comment I always do when this happens: the answer is not more sever side hashing.<p>Trusting remote services with plaintext passwords is broken to begin with. We shouldn't give them the chance to mess this up. We need client side hashing and key-stretching that only something <i>like</i> SRP can provide:<p><a href="https://en.wikipedia.org/wiki/Secure_Remote_Password_protocol" rel="nofollow">https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...</a><p>The sooner we stop pretending there are no better answers than sending the contents of a password field raw over the wire, over SSL or not, and the sooner the web browser vendors and W3C start fixing this, the better. TLS-SRP is a ray of hope, but we need lighter, easier to deploy solutions that work at the application level rather than below HTTP.<p>On what alternate reality are we living where the W3C are working on Javascript cryptography before improving basic, fundamental, built-in  authentication?