I didn't say it was easy; it's usually pretty hard/expensive to do it right. But there are known best practices, and it looks like those weren't followed (at t

I didn't say it was easy; it's usually pretty hard/expensive to do it right. But there are known best practices, and it looks like those weren't followed (at the very least, have a good password policy and salt the goddammed passwords before hashing). here are two examples of companies doing security right: [1] http://blog.lastpass.com/2011/05/lastpass-security-notification.html http://blog.lastpass.com/2011/05/lastpass-security-notificat... [2] http://arstechnica.com/gaming/news/2011/11/valve-confirms-steam-hack-credit-cards-personal-info-may-be-stolen.ars http://arstechnica.com/gaming/news/2011/11/valve-confirms-st...