League of Legends database compromised, passwords hashed without salt
euw.leagueoflegends.com
League of Legends database compromised, passwords hashed without salt
1–10 of 109 posts
Re: League of Legends database compromised, passwords hashed without salt
#2It says encrypted not hashed, these are not the same thing. Encryption uses keys and without the keys you can't get the value without a huge brute force effort. Hash without salt can be broken trivially. It'd bad either way but encrypted is way better than leaked hash.
Re: League of Legends database compromised, passwords hashed without salt
#3Just be sure you don't use your LoL password on any other game/email. The hackers will very likely test the info against your email and diablo 3.
Re: League of Legends database compromised, passwords hashed without salt
#4It says encrypted not hashed, these are not the same thing. Encryption uses keys and without the keys you can't get the value without a huge brute force effort. Hash without salt can be broken trivially. It'd bad either way but encrypted is way better than leaked hash.
Later it says "We compared encrypted password hashes" so they are probably hashed.
Re: League of Legends database compromised, passwords hashed without salt
#5Is there a good authentication system that doesn't involve storing passwords, hashed passwords, or encrypted passwords in the master database?
Re: League of Legends database compromised, passwords hashed without salt
#6Is there a good authentication system that doesn't involve storing passwords, hashed passwords, or encrypted passwords in the master database?
Re: League of Legends database compromised, passwords hashed without salt
#7European servers only, according to their release.
Re: League of Legends database compromised, passwords hashed without salt
#8Is there a good authentication system that doesn't involve storing passwords, hashed passwords, or encrypted passwords in the master database?
There's Secure Remote Password, which stores a non-reversible verifier instead: http://en.wikipedia.org/wiki/Secure_Remote_Password_protocol
Apparently it's quite tricky to implement properly though.
Re: League of Legends database compromised, passwords hashed without salt
#9It says encrypted not hashed, these are not the same thing. Encryption uses keys and without the keys you can't get the value without a huge brute force effort. Hash without salt can be broken trivially. It'd bad either way but encrypted is way better than leaked hash.
I was going to ask: is there actually any benefit salting a password that will be encrypted?
Re: League of Legends database compromised, passwords hashed without salt
#10That sounds like a really proffessional letter to their users. Brief, honest, precise, and they clearly state what their action items to prevent this from ever happening again will be. I like it a lot.