3 ms·

No. God, I hope we don't find out they're use symmetric encryption. Do I need to explain why that's a stupid idea? In case I do: 1) The site doesn't need my pa

No. God, I hope we don't find out they're use symmetric encryption. Do I need to explain why that's a stupid idea? In case I do: 1) The site doesn't need my password in plaintext. 2) If the server is compromised, the attackers don't just have salted or unsalted hashes THEY HAVE FULL PLAINTEXT PASSWORDS (unless it's some weird case where they have DB but not FS access). No, either way, they're wrong. (Sigh, I'm sorry for the snippiness, I'm just tired of coming into everyone of these threads with people who earnestly try to regurgitate what they heard from the last thread about this and manage to give bad advice or implications.)

thaumaturgy 14y ago
No, you didn't need to explain that. (I hear ya though.) Yes, they are probably wrong. However, unlike the recent LinkedIn leak, at the moment we know almost nothing about how they were storing passwords. (Although, according to a thread on their forums, they did leave a user's previous and current passwords both simultaneously active -- not a good sign.) I think that HN didn't used to so readily confuse speculation and facts.
- drivebyacct2 14y ago
  Well, considering they said they compared "hashes" later on, and the hopeful unlikeliness that they were really using symmetric encryption, I feel like it's a pretty sure educated guess and not just a knee-jerk reaction. edit: I didn't mean to be personally chastizing in my first post, I'm just extremely distraught at the advice I see in these threads, the continued confusion of people and the fact that people with massive userbases either aren't paying attention or are in this ignorant group of "it won't happen to me" people.
- deathmonkey 14y ago
  A lot of game companies don't get valid email addresses from most of their user baseso if they don't have a good email to authenticate a password reset, leaving the old password active sometimes is the only option to authenticate users for a password reset.

thaumaturgy 14y ago

No, you didn't need to explain that. (I hear ya though.) Yes, they are probably wrong. However, unlike the recent LinkedIn leak, at the moment we know almost nothing about how they were storing passwords. (Although, according to a thread on their forums, they did leave a user's previous and current passwords both simultaneously active -- not a good sign.) I think that HN didn't used to so readily confuse speculation and facts.

drivebyacct2 14y ago
Well, considering they said they compared "hashes" later on, and the hopeful unlikeliness that they were really using symmetric encryption, I feel like it's a pretty sure educated guess and not just a knee-jerk reaction. edit: I didn't mean to be personally chastizing in my first post, I'm just extremely distraught at the advice I see in these threads, the continued confusion of people and the fact that people with massive userbases either aren't paying attention or are in this ignorant group of "it won't happen to me" people.
deathmonkey 14y ago
A lot of game companies don't get valid email addresses from most of their user baseso if they don't have a good email to authenticate a password reset, leaving the old password active sometimes is the only option to authenticate users for a password reset.