4 ms·
> In response to the breach, Xfinity is urging customers who have used the same password for other websites or apps to change all their passwords immediately.
by arcastroe 3y ago
> In response to the breach, Xfinity is urging customers who have used the same password for other websites or apps to change all their passwords immediately.
If the passwords were hashed and salted, why is this recommended? Is this due to brute-force risk?
- gustavus 3y agoPossibly, given my experience in InfoSec though, and knowing Xfinity/Comcast's reputation. It probably is all stored in plaintext in a database that was written in 1975 and rather than bother spending the time and money to upgrade management just keeps saying "things are fine this is fine the ALE doesn't justify the upgrade right now" and so the passwords are probably stored in plaintext.
- tkems 3y agoEven if passwords are salted and hashed, easily guessed passwords can still be brute forced (think password123). Even with good password hashing algorithms like PBKDF2 (I have no idea what Comcast was using, but this is what LastPass uses) with a high cost value, this can be attempted for the most common passwords fairly quickly. This also occurs 'offline', meaning that an attacker doesn't have to attempt to login to the webpage to try to brute force the passwords, it happens all on the attackers machine because they have a copy of the database. On top of this, lots of people reuse passwords which makes this an attractive target for such attacks.