4 ms·
There's absolutely nothing in this email saying they stored passwords in "clear text". They could have been stored hashed with an older algorithm. Maybe not t
by orev 17y ago
There's absolutely nothing in this email saying they stored passwords in "clear text". They could have been stored hashed with an older algorithm. Maybe not the best thing to do, but that's not the same as clear text. If someone obtained the hashed passwords, they might be able to crack them (salted or not).
They are doing the responsible thing by informing their users. It's posts with titles like this that prevent more companies from disclosing security breaches.
- jason_tko 17y agoActually, it turns out storing passwords in cleartext is exactly what they did. I think it's worthwhile for everyone to be aware of the ramifications and problems associated with this. Their second response was far better, and addresses all of the concerns their first response generated.
- streety 17y agoI assume this is the second response: http://blogs.atlassian.com/news/2010/04/oh_man_what_a_day_an_update_on_our_security_breach.html http://blogs.atlassian.com/news/2010/04/oh_man_what_a_day_an... Presumably if this was an unmaintained legacy system if you had changed your password since July 2008 your account would be safe. There is no mention of this though.