5 ms·
I wouldn't say 'fine'. They say the hashes were salted (which is good), but it's not clear whether all the salt was also leaked.
by Cyphase 14y ago
I wouldn't say 'fine'. They say the hashes were salted (which is good), but it's not clear whether all the salt was also leaked.
- pjscott 14y agoThe salt is included in the serialized form of the bcrypt hash, so yes they were leaked. Secrecy isn't their purpose.
- xxpor 14y agoSalts are considered public in terms of if they are leaked it's not damaging in and of itself. The entire purpose of them is to prevent people with the same password having the same password hash. Now if the salt was your name or something that's a different problem.
- elithrar 14y ago> The entire purpose of them is to prevent people with the same password having the same password hash. ... which helps prevent against the use of existing rainbow tables, as the hash from site A won't be the same as site B, even if the underlying password is the same.