I'm using Yahoo mail and when I logged in, they gave me a link to their security notice. About 'Hashed passwords', it says: "At the time of the August 2013 inc

I'm using Yahoo mail and when I logged in, they gave me a link to their security notice. About 'Hashed passwords', it says: "At the time of the August 2013 incident, we used MD5 to hash passwords. We began upgrading our password protection to bcrypt in the summer of 2013. Bcrypt is a password hashing mechanism that incorporates security features, including salting and multiple rounds of computation, to provide advanced protection against password cracking." WOW. So basically they did not even salt their passwords until 3 years ago! I knew about the importance of salting password hashes since I was like 17 years old and this mega billion-dollar corporation did not. Also, they claim: "Hashing is a one-way mathematical function that converts an original string of data into a seemingly random string of characters. As such, passwords that have been hashed can’t be reversed into the original plain text password." Which in the case of MD5 is a deceptive claim; even a basic dictionary attack could probably reverse at least 50% of all their accounts' MD5-hashed password (assuming most people use one-word passwords with maybe a few digits at the end).