4 ms·

I think the reason people like to know this detail is so they can gauge how urgently they need to act and change their password(s). If the attackers got plaint

I think the reason people like to know this detail is so they can gauge how urgently they need to act and change their password(s). If the attackers got plaintext data (worst-case) and users re-used logins on other sites, it's a 'holy shit drop everything and change passwords now' moment. If Ebay followed best practices then affected users know they can wait a day or two and update passwords at a convenient time. Hashing, salting, encrypting all buy you time to react. Your other comment is correct though, once a password database is compromised all those affected must assume it will be cracked and so they must change passwords. The only variable is how quickly they should act.

dchest 12y ago
Passwords leaked 3 months ago, it's "holy shit drop everything and change passwords now" moment in any case.
MasterScrat 12y ago
If used properly, can't the good hashing techniques be "safe", at least if the salt is not leaked?
- dchest 12y ago
  Good hashing techniques store "salt" along with password. Salt is not a secret key, it's a public value used to make password hashes unique. Good hashing techniques increase costs for attackers to brute-force passwords. If they securely encrypted passwords or password hashes, and the key was not leaked, then passwords are safe. However, the probability of attackers stealing the database of passwords and not stealing the encryption key for it is pretty low. Knowing anything of this still doesn't affect user actions, who should change eBay passwords and never reuse them for anything else.
- mnw21cam 12y ago
  You're thinking of pepper, not salt. Salt is a random value that is added to a password before it is hashed, so that two identical passwords do not hash to the same value. The value is different for each hashed password, and is stored alongside the hash. Pepper is a configured value that is the same for all hashed passwords, and is added to the password (and salt) before it is hashed. It is kept secret, and effectively turns the hash function into a secret hash function. Its merit can be argued because if an attacker is able to compromise your hashed password database, they could possibly have compromised your configuration and discovered the pepper too. However, it does add an extra hurdle for an attacker.

dchest 12y ago

Passwords leaked 3 months ago, it's "holy shit drop everything and change passwords now" moment in any case.

MasterScrat 12y ago

If used properly, can't the good hashing techniques be "safe", at least if the salt is not leaked?

dchest 12y ago
Good hashing techniques store "salt" along with password. Salt is not a secret key, it's a public value used to make password hashes unique. Good hashing techniques increase costs for attackers to brute-force passwords. If they securely encrypted passwords or password hashes, and the key was not leaked, then passwords are safe. However, the probability of attackers stealing the database of passwords and not stealing the encryption key for it is pretty low. Knowing anything of this still doesn't affect user actions, who should change eBay passwords and never reuse them for anything else.
mnw21cam 12y ago
You're thinking of pepper, not salt. Salt is a random value that is added to a password before it is hashed, so that two identical passwords do not hash to the same value. The value is different for each hashed password, and is stored alongside the hash. Pepper is a configured value that is the same for all hashed passwords, and is added to the password (and salt) before it is hashed. It is kept secret, and effectively turns the hash function into a secret hash function. Its merit can be argued because if an attacker is able to compromise your hashed password database, they could possibly have compromised your configuration and discovered the pepper too. However, it does add an extra hurdle for an attacker.