5 ms·
"Adobe says that they've followed best practices for password storage and protection for more than a year now, as their authentication systems were upgraded to
by nightcracker 13y ago
"Adobe says that they've followed best practices for password storage and protection for more than a year now, as their authentication systems were upgraded to use SHA-256, with salt, to protect customer passwords."
Absolute bullshit! SHA-256 with salt is totally inadequate for password storage, they should use a PBKDF like scrypt.
- viraptor 13y agoDepends on the number of rounds used. It can be brought up to a reasonable time complexity this way and is definitely not inadequate. Worse than some alternatives? Sure. But it still gives reasonable protection.
- brohee 13y agoIf they said SHA-256 with salt, excuse us to think it is just that, with no iteration. If it's iterated SHA-256 it becomes a lot closer to PBKDF and one wonder why they would not use it. Given Adobe history wrt security, let us assume the worst.
- viraptor 13y agoThat is the standard in the password libraries really. passlib uses thousands of rounds of sha-256, so does glibc, etc. Unless they implemented the whole thing from scratch, they wouldn't be using a single run of sha-256. It's not impossible, but I'd say at this point it's unlikely they're doing something silly - it would be a job terminating mistake for whoever implemented the new system after the last fiasco.