How We Got Owned by a Few Teenagers (and Why It Will Never Happen Again)

Re:How We Got Owned by a Few Teenagers (and Why It Will Neve... by Popcorned23 on Tuesday March 22, 2011 @08:56PM (#2357379)

Here's an interesting tweet from one of their developers.

http://twitter.com/ReinH/status/50348989366796288

> Your password in the database is SHA512 encrypted, but we're not taking chances.

I hope he knows what he's talking about and is just tired from the past few days.

[ Parent | on HN ]

Re:How We Got Owned by a Few Teenagers (and Why It Will Neve... by 16s on Tuesday March 22, 2011 @09:08PM (#2357415)

Let's hope they are salted and iterated.

[ Parent | on HN ]

Re:How We Got Owned by a Few Teenagers (and Why It Will Neve... by jarin on Tuesday March 22, 2011 @09:28PM (#2357474)

Or swapped over to Bcrypt

[ Parent | on HN ]

Re:How We Got Owned by a Few Teenagers (and Why It Will Neve... by lyonheart on Wednesday March 23, 2011 @03:03PM (#2360798)

we've cleared the old SHA512-salted passwords out of our production database and have upgraded the password hashing to bcrypt, with a cost of 10.

[ Parent | on HN ]

Re:How We Got Owned by a Few Teenagers (and Why It Will Neve... by jarin on Wednesday March 23, 2011 @04:29PM (#2361282)

Good call :)

Just in case anyone doesn't know why Bcrypt is so awesome, it's because it actually takes longer to hash (based on the difficulty level you set, and you can bump up the difficulty level as hardware gets more powerful).

For other applications, you want hashing to be fast. But for passwords, you want hashing to be as slow as possible without compromising user experience.

[ Parent | on HN ]

Re:How We Got Owned by a Few Teenagers (and Why It Will Neve... by lyonheart on Wednesday March 23, 2011 @07:04PM (#2361892)

I wanted Lucas to link to Coda Hale's post on bcrypt (found by googling "Coda Hale bcrypt") in the blog post, but he edited that out. So it goes.

[ Parent | on HN ]