4 ms·
The adage "Better safe than sorry" comes to mind. And a leak doesn't need evidence that it was accessed to be deemed a leak. They were stored in plaintext, pot
by prophesi 8y ago
The adage "Better safe than sorry" comes to mind.
And a leak doesn't need evidence that it was accessed to be deemed a leak. They were stored in plaintext, potentially accessible by internal employees. That's enough to warrant a password reset. It's not asking for much.
One should only entrust their password to a hashing algorithm.
- tptacek 8y agoI guess if there's such a thing as an "internal leak", that's what this is. The word "leak", by itself, connotes an exposure that is not in evidence, and given the sensitivity of the topic, I think precision is called for.
- prophesi 8y agoYes, when it comes to this sort of sensitive information, there is such a thing as an internal leak. We've had PCI-compliance to ensure companies handle credit card information properly. Then we have GDPR and similar laws for personally identifying information. Access to account credentials for a large social media platform definitely falls into the sensitive & personally-identifying category.