News for hackers. Stuff that matters.

A comment on Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords. Parent comment

Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by omra on Tuesday September 25, 2012 @04:42PM (#4572551)
Only doing that won't help. You might as well be transmitting the password, since someone can just copy the hash and then it would be equivalent to having the password. (Also known as a Pass the Hash attack, http://en.wikipedia.org/wiki/Pass_the_hash).
[ Parent | on HN ]
Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by wisty on Tuesday September 25, 2012 @05:06PM (#4572661)
Each website could have a salt. The issue is, if it's not a secure connection, it's vulnerable to hijacks.
[ Parent | on HN ]