4 ms·
"It Takes 6 Days to Change 1 Line of Code" https://news.ycombinator.com/item?id=13119138 https://news.ycombinator.com/item?id=13119138 I'm going to go out on a
by haser_au 10y ago
"It Takes 6 Days to Change 1 Line of Code"
https://news.ycombinator.com/item?id=13119138 https://news.ycombinator.com/item?id=13119138
I'm going to go out on a limb and guess you've never worked as a software engineer in a large organisation.
Given MD5 hashes are currently stored, how do you propose user's password get converted to SHA256/512? Should Yahoo brute force the passwords, and then store them in the new algorithm? Or should they wait for the user to log on, verify their password, and store it in the new hash algorithm (given some users rarely log on, this could take over 12 months to complete 80% of users).
- flukus 10y agoYes it could take months or years to complete the process, but they've had at least a decade. Even if it never completes (abandoned accounts), it would still have saved most active accounts from being breached.
- haser_au 10y ago100% agree. Yahoo should have started the process a long time ago. I was just replying to the comment it could be completed in an afternoon.
- pbhjpbhj 10y agoYou're right on the first count. It wasn't sarcasm, it was a question. On the storing of hashes though the standard protocol has been to pass the hash in as if it were a password.