The New York Times recently switched from one paid membership management system to another, and they changed the username and password of every paid account. For some reason, they've posted the system they used to choose new usernames and passwords on the Web for anyone to see. Security is certainly a difficult problem, and password management is even harder than most security problems, but it's much worse when you don't even try. If you have a paid nytimes.com subscription, be sure to read this.

[ Read more ]