Re:65M Tumblr Passwords for Sale on TheRealDeal
by iLoch on Tuesday May 31, 2016 @11:02PM
(#11811825)
Yup there are just a lot of bad developers out there, quite honestly.
Re:65M Tumblr Passwords for Sale on TheRealDeal
by ssharp on Wednesday June 01, 2016 @10:54AM
(#11814781)
For big sites, I have a hard time blaming it on a bad developer. Early in my career, I worked for a company that stored it's passwords in plain-text. I suggested on many occasions stop doing this and was always told no because the site had an older audience and they wanted to make it easy to send password reminders, which also meant they were emailing passwords in plain-text. This came from the tech director and CEO and none of the other devs seemed to care.
A few years after I left, their DB was compromised, so someone got a list of email addresses with clear text passwords.
But some of the password hashing algos used, no salting, making all password characters lower-case in the background, etc. are not hard things to avoid. So when a site is hacked and the user information stolen and we find that stuff out, it's safer to assume other security practices where also subpar.