Someone probably just mixed up the hash keys for the password field and the hint field. The hint needs to be stored unencrypted so that it can be displayed.
Agree. It's probably an issue with the form, nothing underlying. (which means encrypted containers created via the command line should be safe from this vulnerability?)
Probably some unthinking tester was just using the same string in both fields (e.g. “test”). As a developer I’ve learned over the years not to do that. That tester should have their work attitude adjusted and their methods thoroughly reviewed.
There’s probably some easy explanation but why is there a need separate code to store variables for the ssd vs hdd version? I would think this would be high level code, abstracted far away from any hardware differences
Glass half-empty: "Oh-my-goodness...what would Steve say? FFS. We can't trust anyone any more!"
I'm inclined to be half-full.