3 ms·
In the first sentence, he links to a previous post where it's made more clear that he's talking about Stack Overflow. > I found what one could call a security
by rcfox 7y ago
In the first sentence, he links to a previous post where it's made more clear that he's talking about Stack Overflow.
> I found what one could call a security hole in Stackoverflow. I'm curious enough to go digging around for holes, but too ethical to actually do anything with them.
- 0xffff2 7y agoI hate to say this, but did you even read the post you actually linked? From the second post (the one you linked), where Jeff quotes the hacker: >>I guess I can tell you, so you don't fall into this trap again. There's a site I help out with that doesn't salt their passwords. They're MD5 encrypted, but if you've got a dictionary password, it's very easy to use a reverse-MD5 site to get the original. I was able to figure out you were a user on the site some time back, and realized I could do this, if only I knew your openid provider... The "password vulnerability involving unsalted hashes" was on another site. The hacker was only able to gain access to Jeff's Stack Overflow account through a combination of their privileged access to the database for that other site and Jeff's own bad op-sec. The only real security error attributable to Stack Overflow in any way was Jeff's own and had nothing to do with Stack Overflow's infrastructure.