6 ms·
EHarmony confirms password breach
- jgrahamc 14y agoAnd apparently they were using unsalted MD5.
- jwoah12 14y agoIt'll be interesting to see if these two breaches lead to either: 1. A large number of websites realizing that their lazy authentication is a time bomb, and fixing it. 2. A large number of attackers realizing that many more websites probably have this kind of vulnerability, and exploiting it.
- weego 14y agoI imagine in reality one will try and out-race the other to the outcome they want (most likely 2 will beat 1).
- aaronharnly 14y agoAre both of these sites (LinkedIn, eHarmony) really assuming that only the hashes posted to the forum thread have been compromised? Isn't that, well, a really really bad assumption?
- jimm 14y agoAnother reason I'm glad that I'm married (and faithful)!
- jwoah12 14y agoThat brings up an interesting thought. I wonder how ashleymadison.com stores its user data. If any piece of identifying user data were leaked, it could kill their business (which many would welcome I'm sure).
- jgrahamc 14y agoIf I were a criminal hacker with access to ashleymadison.com user data I wouldn't be talking about it. I'd be blackmailing wealthy people who are cheating on the site or the site itself. So, I doubt you'd hear about such a hack.
- nulluk 14y agoWith all these breaches my idea for a browser extension that stores a blacklist of websites & warns you about them mailing plaintext passwords, insecure password authentication or storing credit card details BEFORE I sign up has never been more appealing