14 ms·
That doesn't matter if someone has a dump of the database. Which as Sony can tell you, is becoming more common.
by city41 15y ago
That doesn't matter if someone has a dump of the database. Which as Sony can tell you, is becoming more common.
- brianbreslin 15y agogood point. i'll have to read up on how sony's db got extracted first then.
- bonzoesc 15y agoSQL injection, social engineering a password, somebody's crappy "secret question," insecure PHP, and hundreds of other ways. Closing off known avenues of attack and still mitigating against a leak with peer-reviewed math is what you have to do.
- pragmatic 15y agoYes, but once you are in to the point where you have the db...what else are you going after? If you can dump the db then (most likely) you also have the credit cards, other information that is useful to you? This assumes a hacker has a financial motivation.
- city41 15y agoI would hope the db didn't store credit card info or at least encrypted it somehow. Granted that's a pretty big hope. But if you can crack the passwords in the db you have, chances are those passwords will work on other sites. People often use one password for everything.
- ceejayoz 15y ago> Yes, but once you are in to the point where you have the db...what else are you going after? There are many conceivable attacks that would result in a read-only dump of password hashes. An administrator's account would be useful in such an administration, turning your read-only access to read-write access.
- barrkel 15y agoPasswords are frequently reused.