3 ms·

Many breaches in the past revealed that passwords were somehow "hashed" or "encrypted" in ways that made it much easier than necessary for the attacker to obtai

Many breaches in the past revealed that passwords were somehow "hashed" or "encrypted" in ways that made it much easier than necessary for the attacker to obtain the clear text passwords. For example if passwords are only hashed with md5, with no salt, that's basically worthless; md5 is simply too easy to brute force. Same for sha1 (not quite as easy to reverse, but rainbow tables help). So the mere fact that the passwords were somehow "secured" doesn't mean much by itself.

dchest 12y ago
I know that different password storage schemes provide different security. I don't see how knowing what particular scheme they used would affect your actions.
- sgk284 12y ago
  If you use a secure password and the scheme the company uses is something like scrypt or bcrypt with high work factors, you can be near-certain that your password won't be cracked by an attacker. The amount of computation is just extraordinary. That said, you would still probably want to change your password if you're paranoid.
  - dchest 12y ago
    If you are capable of estimating the cost of cracking your password, you're capable of understanding that you should use different passwords on different websites and that you should change your password in event of compromise. In which case, the fact that attackers know your leaked password doesn't change anything. The same thing applies to knowing the particular password hash they used: if your password had enough entropy, attackers won't be able to break it even if eBay used "unsalted" SHA-1. But this doesn't change anything, because see previous paragraph. If, say, your grandfather used the same password for Hotmail and eBay, and he tells you that his password was "bestjetpilot"[1], and asks for your advice on what to do, will you tell him to change both passwords, or just the eBay one? What if he used "y62BYmHoCsjScov6QSOgGCL"? What would you tell him? How would your advice change if you knew the particular password storage scheme eBay used? Do you now need to know which scheme Hotmail uses, because the password is reused on both websites? [1] http://pages.ebay.com.au/help/account/create-password.html http://pages.ebay.com.au/help/account/create-password.html
    - hackinthebochs 12y ago
      >and that you should change your password in event of compromise. This doesn't follow. If you estimate that the cost of cracking your password is infeasibly high, there is no reason to change your password.
      - dchest 12y ago
        Which is a confirmation that you cannot properly estimate risk/effort involved; the knowledge of the scheme they used to store passwords is useless for you, or even harmful.

dchest 12y ago

I know that different password storage schemes provide different security. I don't see how knowing what particular scheme they used would affect your actions.

sgk284 12y ago
If you use a secure password and the scheme the company uses is something like scrypt or bcrypt with high work factors, you can be near-certain that your password won't be cracked by an attacker. The amount of computation is just extraordinary. That said, you would still probably want to change your password if you're paranoid.
- dchest 12y ago
  If you are capable of estimating the cost of cracking your password, you're capable of understanding that you should use different passwords on different websites and that you should change your password in event of compromise. In which case, the fact that attackers know your leaked password doesn't change anything. The same thing applies to knowing the particular password hash they used: if your password had enough entropy, attackers won't be able to break it even if eBay used "unsalted" SHA-1. But this doesn't change anything, because see previous paragraph. If, say, your grandfather used the same password for Hotmail and eBay, and he tells you that his password was "bestjetpilot"[1], and asks for your advice on what to do, will you tell him to change both passwords, or just the eBay one? What if he used "y62BYmHoCsjScov6QSOgGCL"? What would you tell him? How would your advice change if you knew the particular password storage scheme eBay used? Do you now need to know which scheme Hotmail uses, because the password is reused on both websites? [1] http://pages.ebay.com.au/help/account/create-password.html http://pages.ebay.com.au/help/account/create-password.html
  - hackinthebochs 12y ago
    >and that you should change your password in event of compromise. This doesn't follow. If you estimate that the cost of cracking your password is infeasibly high, there is no reason to change your password.
    - dchest 12y ago
      Which is a confirmation that you cannot properly estimate risk/effort involved; the knowledge of the scheme they used to store passwords is useless for you, or even harmful.