3 ms·

TL:DR - email addresses and password hashes leaked for users registered until 2017-10-26, affecting 92m accounts. No password reset, no mention of usage of sal

TL:DR - email addresses and password hashes leaked for users registered until 2017-10-26, affecting 92m accounts. No password reset, no mention of usage of salts, no mention of hash algorithm used, (edit: originally said no 2FA, but 2FA was added, thanks bbarn), no auditing to confirm that other systems were not leaked ("we have no reason to believe those systems have been compromised"), internal investigation has been fruitless so far (for two and a half weeks).

bbarn 8y ago
https://blog.myheritage.com/2018/06/new-myheritage-adds-two-factor-authentication-2fa-to-secure-your-account/ https://blog.myheritage.com/2018/06/new-myheritage-adds-two-...
- solatic 8y ago
  Noted and edited, thanks
  - sundvor 8y ago
    It's somewhat amusing to hear of people buying dashcams after they've had a crash. That's all I can think of when I see companies scramble to secure their sites after they've been compromised.
magnat 8y ago
> no mention of usage of salts They wrote "MyHeritage does not store user passwords, but rather a one-way hash of each password, in which the hash key differs for each customer". I believe "different hash key for each customer" means either nonce or salt.
- solatic 8y ago
  It's ambiguous, I read it as the hashes being different for each customer out of a mistaken assumption that no two customers have the same password. A salt isn't really a "key" for a hash function, because it isn't going to tell you by itself what the original unhashed value is, and neither will it by itself give you the final hash.
  - KMag 8y ago
    But a salt is a key in the same sense as a MAC key (such as HMAC key).