Re:Yahoo discloses hack of 1B accounts
by haser_au on Wednesday December 14, 2016 @09:02PM
(#13181725)
"It Takes 6 Days to Change 1 Line of Code"
https://news.ycombinator.com/item?id=13119138
I'm going to go out on a limb and guess you've never worked as a software engineer in a large organisation.
Given MD5 hashes are currently stored, how do you propose user's password get converted to SHA256/512? Should Yahoo brute force the passwords, and then store them in the new algorithm? Or should they wait for the user to log on, verify their password, and store it in the new hash algorithm (given some users rarely log on, this could take over 12 months to complete 80% of users).
Re:Yahoo discloses hack of 1B accounts
by flukus on Wednesday December 14, 2016 @09:43PM
(#13181942)
Yes it could take months or years to complete the process, but they've had at least a decade.
Even if it never completes (abandoned accounts), it would still have saved most active accounts from being breached.
Really? Moving from doing md5(password) to bcrypt(password,salt)? I see organisations make things hard and legacy code-base, yadda, yadda but surely if Yahoo couldn't do this then they couldn't manage scratching their own butt; it really seems like quite a small change in the scheme of things. Like one senior engineer, one afternoon of work (then testing, etc., OK, sure) ... ?