On: Reputation.com Loses User Passwords, Emails, and A...

[tptacek]

I really hate that OWASP page (it's not as bad as it used to be --- that is, godawful --- and now it's just incoherent) and think we shouldn't be directing developers to it. If there's something "OWASP" (whatever that is) is truly bad at, it's cryptography.

[ineedtosleep → tptacek]

I usually rely on OWASP for general guidelines, but if that page isn't enough for you, what is? (not a rhetorical question)

What should one look into in order to fill in OWASP's gaps?

[gcr → tptacek]

What things would you change?

[gcr → tptacek]

What's wrong with it?