Zappos.com customer database compromised • Hacker News Board

Re: Zappos.com customer database compromised

#91

Post by tvaughan » Mon, Jan 16, 2012, 8:56 PM UTC

jjacobson wrote: post #86

tvaughan wrote: post #72

Earlier quoted context omitted.

I'm in Chile as part of Start-Up Chile. What exactly do you need? PS - I am also a US customer. A block on international traffic effects more than just international customers.

Manpacks.com is a great example of a company that started up to fill the void left when Zappos stopped shipping to Canada.

Ah, I understand now. You mean you want companies to just replicate Zappos outside the US. Any chance that there could be a "Zappos API" where we could while label Zappos, and pick-up the goods at the Zappos warehouse for foreign shipment?

Re: Zappos.com customer database compromised

#92

Post by lancewiggs » Sun, Jan 22, 2012, 6:04 AM UTC

jjacobson wrote: post #50

lancewiggs wrote: post #37

Earlier quoted context omitted.

I for one would love Zappos to ship internationally, and your owners at Amazon already do. I know you can't comment, but please do what you can to push for selling to the other 6.7 billion of us.

It'd be cool if we could ship internationally. What would be even cooler is if we could inspire entrepeneurs in other countries to tackle it!

try http://fifty one.com. They seem to be still growing, but facilitate international payments and shipping for a bunch of companies.

Re: Zappos.com customer database compromised

#93

Post by newman314 » Mon, Jan 23, 2012, 8:37 PM UTC

xp84 wrote: post #89

jjacobson wrote: post #62

Earlier quoted context omitted.

I'm guessing posting anything about our password hashing will be frowned upon due to the context of this question. What are the best practices you want to see a website use when storing your password?

Salt. Seriously. A big, long, gnarly-looking salt. Preferably a unique salt per user. Really, even just that is sufficient, even if stored right next to the hash. It means doing a bruteforce/dictionary attack one user at a time rather than one bruteforce/dictionary attack of all the users at once (static salt) or just googling the hash (unsalted hash). Also, are these passwords encrypted or hashed? Those two are mile…

Salt is no longer sufficient.