4 ms·

Thanks for your transparency, but can you be more specific about when the switch from SHA-1 to bcrypt occurred? If it was 6 (or more) months ago, then I think

by sjm-lbm 13y ago

Thanks for your transparency, but can you be more specific about when the switch from SHA-1 to bcrypt occurred? If it was 6 (or more) months ago, then I think you'll find at least some sympathy here - "break things" sometimes happens after "move fast," and I'm sure we've all put some code in production that, in retrospect, we wish we hadn't. However, your statement is still technically correct if the switch to bcrypt happened late this week (ie, after the breach was made known to Kickstarter), and that worries me.

tptacek 13y ago
This is about as reasonable as asking whether they got hacked a year ago, did nothing, and didn't tell anyone. Only now do they tell us that law enforcement informed them. Read between the lines, man. Inhales.
- sjm-lbm 13y ago
  Ha, fair enough - that statement was excessively cynical. Thanks for being a voice of reason on this issue.
  - tptacek 13y ago
    Thank you for taking my snippiness in the constructive spirit I now rationalize it as being intended in. ;)