Hack of Cupid Media dating website exposes 42 million plaintext passwords
Before the bcryot/scrypt advocacy and general shaming starts... I'll just make the same comment I always do when this happens: the answer is not more sever side hashing.Trusting remote services with plaintext passwords is broken to begin with. We shouldn't give them the chance to mess this up. We need client side hashing and key-stretching that only something like SRP can provide:https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco...The sooner we stop pretending there are no better answers than sending the contents of a password field raw over the wire, over SSL or not, and the sooner the web browser vendors and W3C start fixing this, the better. TLS-SRP is a ray of hope, but we need lighter, easier to deploy solutions that work at the application level rather than below HTTP.On what alternate reality are we living where the W3C are working on Javascript cryptography before improving basic, fundamental, built-in  authentication?