eBay user data for sale?

Post by bfish510 » Thu, May 22, 2014, 3:40 PM UTC

thefreeman wrote: post #22

Mithaldu wrote: post #18

Earlier quoted context omitted.

The passwords look like this: pbkdf2_sha256$12000$zhMKabMgayvK$iniviUCcX9y2PYJcm0AoB3MhybRA1z2Cec1DZnLWxWc= I do not know how much time it would take to bruteforce these. Can any experienced HNers weigh in?

I am not an expert by any means, but I believe pbkdf2 is a recommended key stretching function for a hashing method (which looks to be sha256). http://en.wikipedia.org/wiki/PBKDF2 I think cracking difficulty depends on how many "iterations" they use though.

Post by bsaul » Thu, May 22, 2014, 3:41 PM UTC

coldcode wrote: post #25

All personally identifiable data should be stored in a non usable form. You'd think people by now would know that eventually your data will leave your protection.

Post by kej » Thu, May 22, 2014, 3:42 PM UTC

ForHackernews wrote: post #5

I have an eBay account, but I haven't used it in years, and I doubt I remember the password. How worried about this should I be? Are there plaintext passwords exposed, or do they just have a lot of properly salted hashes that aren't much use to an attacker?

Post by scottydelta » Thu, May 22, 2014, 3:45 PM UTC

Post by hamidr » Thu, May 22, 2014, 3:48 PM UTC

scottydelta wrote: post #37

Haha, smartasses :D