3 ms·
To be fair the hacker didn't say the keys were stored on the same server as the credit card numbers, he said they were stored on the web server. It's most like
by tmcneal 14y ago
To be fair the hacker didn't say the keys were stored on the same server as the credit card numbers, he said they were stored on the web server. It's most likely the database containing the CC numbers resides on a separate set of boxes than the web servers.
- nenolod 14y agothe database server is local, read the entire log...
- danielweber 14y agoThe Cigital-recommended way to hash your passwords is to use an HMAC/scrypt combo, with the HMAC key stored on the app server (not the database). What Linode did may, or may not, be dumb. They are being tight-lipped so we can only guess.
- lawnchair_larry 14y agoWhy would you use an HMAC for password storage? It's not like length extension attacks are relevant in that application.