3 ms·
Plaintext in 2015 ! Inexcusable.
by deepnet 11y ago
Plaintext in 2015 ! Inexcusable.
- steckerbrett 11y agoShouting "encryption" isn't a whole lot better really. You can use "military grade encryption" all you want, but if the server it is stored on has the keys there's extremely little point except the feel-good vibes.
- sp332 11y agoThe attackers stole legitimate login credentials. Encryption wouldn't help with that.
- carbocation 11y agoI run a bunch of websites which store bcrypted hashes of users' passwords. If you had my SQL login, you'd just find bcrypted hashes. It would absolutely prevent you from discovering their actual passwords in a meaningful amount of time.
- technion 11y agoYou would, however, have plaintext copies of every piece of other sensitive information in that database. Who cares is passwords are harder to brute force, once an attacker has walked away with everything in the OPM leak? Don't get me wrong, I'm hugely in favour of hashed passwords. But with this sort of data it's a long way from making a complete database leak a nonissue.
- carbocation 11y agoI was responding to a comment about plaintext login credentials. I'm not claiming that bcrypting passwords somehow makes a database full of exquisitely private details somehow unimportant.