The official announcement post makes use of the phrase "salted and hashed passwords" but omits the fact that it was probably SHA1 with a three-byte salt. A Red

The official announcement post makes use of the phrase "salted and hashed passwords" but omits the fact that it was probably SHA1 with a three-byte salt. A Reddit admin does confirm in a later comment that it was SHA1 that was used [1]. This information regarding the salt was only available because Reddit was open sourced for a while and the oldest commit (from 2008) still uses that hashing scheme. [2] Let this be yet another reminder that SMS 2FA is not secure. [1]: https://np.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/e3f8kqa/ https://np.reddit.com/r/announcements/comments/93qnm5/we_had... [2]: https://np.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/e3fkvtq/ https://np.reddit.com/r/announcements/comments/93qnm5/we_had...