4 ms·

If you use a secure password and the scheme the company uses is something like scrypt or bcrypt with high work factors, you can be near-certain that your passwo

by sgk284 12y ago

If you use a secure password and the scheme the company uses is something like scrypt or bcrypt with high work factors, you can be near-certain that your password won't be cracked by an attacker. The amount of computation is just extraordinary. That said, you would still probably want to change your password if you're paranoid.

dchest 12y ago
If you are capable of estimating the cost of cracking your password, you're capable of understanding that you should use different passwords on different websites and that you should change your password in event of compromise. In which case, the fact that attackers know your leaked password doesn't change anything. The same thing applies to knowing the particular password hash they used: if your password had enough entropy, attackers won't be able to break it even if eBay used "unsalted" SHA-1. But this doesn't change anything, because see previous paragraph. If, say, your grandfather used the same password for Hotmail and eBay, and he tells you that his password was "bestjetpilot"[1], and asks for your advice on what to do, will you tell him to change both passwords, or just the eBay one? What if he used "y62BYmHoCsjScov6QSOgGCL"? What would you tell him? How would your advice change if you knew the particular password storage scheme eBay used? Do you now need to know which scheme Hotmail uses, because the password is reused on both websites? [1] http://pages.ebay.com.au/help/account/create-password.html http://pages.ebay.com.au/help/account/create-password.html
- hackinthebochs 12y ago
  >and that you should change your password in event of compromise. This doesn't follow. If you estimate that the cost of cracking your password is infeasibly high, there is no reason to change your password.
  - dchest 12y ago
    Which is a confirmation that you cannot properly estimate risk/effort involved; the knowledge of the scheme they used to store passwords is useless for you, or even harmful.

by sgk284 12y ago

dchest 12y ago

If you are capable of estimating the cost of cracking your password, you're capable of understanding that you should use different passwords on different websites and that you should change your password in event of compromise. In which case, the fact that attackers know your leaked password doesn't change anything. The same thing applies to knowing the particular password hash they used: if your password had enough entropy, attackers won't be able to break it even if eBay used "unsalted" SHA-1. But this doesn't change anything, because see previous paragraph. If, say, your grandfather used the same password for Hotmail and eBay, and he tells you that his password was "bestjetpilot"[1], and asks for your advice on what to do, will you tell him to change both passwords, or just the eBay one? What if he used "y62BYmHoCsjScov6QSOgGCL"? What would you tell him? How would your advice change if you knew the particular password storage scheme eBay used? Do you now need to know which scheme Hotmail uses, because the password is reused on both websites? [1] http://pages.ebay.com.au/help/account/create-password.html http://pages.ebay.com.au/help/account/create-password.html

hackinthebochs 12y ago
>and that you should change your password in event of compromise. This doesn't follow. If you estimate that the cost of cracking your password is infeasibly high, there is no reason to change your password.
- dchest 12y ago
  Which is a confirmation that you cannot properly estimate risk/effort involved; the knowledge of the scheme they used to store passwords is useless for you, or even harmful.