At Blind, a security lapse revealed private complaints from tech employees
1–10 of 141 posts
Re: At Blind, a security lapse revealed private complaints from tech employees
#2> The database also contained passwords, which were stored as an MD5 hash
!!!
Re: At Blind, a security lapse revealed private complaints from tech employees
#3> The database also contained passwords, which were stored as an MD5 hash !!!
> Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are managing data. We use more advanced methods like salted hash and SHA2 on securing users’ data in our database.”
!!!!!!
Re: At Blind, a security lapse revealed private complaints from tech employees
#4How incredibly convenient for an anonymous social networking dedicated to complaining about your employer.
Re: At Blind, a security lapse revealed private complaints from tech employees
#5I’m glad to hear at least they don’t seem to be storing ip addresses.
Re: At Blind, a security lapse revealed private complaints from tech employees
#6Sounds like they don’t give a shit and only reacted when TC was going to write a story about it. Surprising given that user trust is at the core of their business, and without it they have nothing.
Re: At Blind, a security lapse revealed private complaints from tech employees
#7> The database also contained passwords, which were stored as an MD5 hash !!!
> Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are managing data. We use more advanced methods like salted hash and SHA2 on securing users’ data in our database.” !!!!!!
Don't worry, they also double ROT13 everything.
Re: At Blind, a security lapse revealed private complaints from tech employees
#8> The database also contained passwords, which were stored as an MD5 hash !!!
> Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are managing data. We use more advanced methods like salted hash and SHA2 on securing users’ data in our database.” !!!!!!
While SSHA2 isnt that bad if they’ve applied a work factor, but that’s probably not the case.
Re: At Blind, a security lapse revealed private complaints from tech employees
#9> The database also contained passwords, which were stored as an MD5 hash !!!
> Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are managing data. We use more advanced methods like salted hash and SHA2 on securing users’ data in our database.” !!!!!!
[deleted]
Re: At Blind, a security lapse revealed private complaints from tech employees
#10Earlier quoted context omitted.
> Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are managing data. We use more advanced methods like salted hash and SHA2 on securing users’ data in our database.” !!!!!!
While SSHA2 isnt that bad if they’ve applied a work factor, but that’s probably not the case.
It's probably better to list what the real solution is: Bcrypt or scrypt.
https://www.npmjs.com/package/bcrypt
I also added it to a fork of Arc that I'm managing. https://github.com/shawwn/arc3.2/tree/ln/src/bcrypt
(Just type `make` and then run Arc like usual. Which is `racket -f as.scm`.)
Thanks to Scott Bell for providing code examples of how to use the racket FFI interface and unix crypt function, and for glancing over the finished code.
That leaves the question of what an appropriate bcrypt work factor is. 10 is apparently about right.