3 ms·
I think at this point it should be standard practice to say what hashing algorithm is used in passwords when disclosing a breach. The email I got from quota ju
by MattBearman 8y ago
I think at this point it should be standard practice to say what hashing algorithm is used in passwords when disclosing a breach.
The email I got from quota just says “encrypted” passwords, and while the blog post says “hashed”, it doesn’t say what algorithm. For all we know it could be something useless like MD5
- mnw21cam 8y agoThis comment should be voted to the top of the conversation. "Hashed" means absolutely nothing these days.
- ShinTakuya 8y agoIt'd be useful in the sense that you'd be able to warn others, but for your own password you should be using a password manager with auto generated random passwords. That way the only thing you need to do is change one password on the leaked site.
- MattBearman 8y agoThat's exactly my point. I use 1password to handle my logins, but most people I speak to use the same password for everything, so knowing how likely it is that other services could be compromised due to this is vital.