Hacker News new | ask | show | jobs
by tree5 6025 days ago
"Agile Web Development With Rails", Chapter 11, Administration
1 comments

Here's the sample code they give in that chapter:

    def self.encrypted_password(password, salt) 
        string_to_hash = password + "wibble" + salt # 'wibble' makes it harder to guess       
        Digest::SHA1.hexdigest(string_to_hash)
    end
They are using SHA1 with a salt, the exact method that security experts recommend against when storing passwords: http://news.ycombinator.com/item?id=995645. And obviously they didn't even use this insecure method internally.

EDIT: tptacek makes a good point. I haven't quite been fair. 37signals did what most companies never do when confronted with a security issue: they quickly acknowledged the problem, fixed it based on the suggestions of the security researchers, and moved on.

You're right. Just give them credit for taking their lumps, apologizing, and getting religion.