New answers tagged

1

Frankly, it doesn't matter and you shouldn't care. The simple reason is that even encrypted passwords can be decrypted given time, so the concern should be whether the user database containing passwords can be obtained by a hacker, through whatever means. As I doubt anyone can say whether a random site is secure, the best practice you can do is to simply ...


3

Is it not best practice to hash passwords? Absolutely, yes. Doesn't mean that it always happens, though. What if I am someone who uses the same password for all of my accounts? Now those accounts are compromised Yes, they are and that's why you shouldn't use the same password for everything. Sorry, but not doing so is also Best Practice. ...


0

Since there is no answer, I'll be bold and propose one, even though I don't completely understand your constraints. First, your question contains a mistake. It is not necessary to "buy" a security certificate. StartSSL (offered by StartCom) is free, and Let's Encrypt (https://letsencrypt.org) is free. There are others, too. But if you don't want to use TLS ...



Top 50 recent answers are included