4 ms·

They kept the usernames in the clear. It is possible to create a service that never stores usernames but only hashes of them too. Keep an email linked to that a

They kept the usernames in the clear. It is possible to create a service that never stores usernames but only hashes of them too. Keep an email linked to that account for a reset of the username / password combo. Then breaches only reveal emails and a pair of hashes, so to control the account you need to control the email.

bengale 10y ago
What is that going to do, the outcome is the attacker still has the password hash and the linked email address?
- SixSigma 10y ago
  So how do they log in without a username & password ?
  - bengale 10y ago
    To your site, they probably don't. But they'll take the email and password and use it elsewhere. You'll have still exposed your customers.
tptacek 10y ago
It is possible to do any number of weird things that practically nobody in the whole world, including companies with the best security teams in the world, actually do. Tokenizing email address is indeed one of those weird things.