Data Breach Reveals 100k IEEE.org Members' Plaintext Passwords

Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by batista on Tuesday September 25, 2012 @05:35PM (#4572799)

No, it won't. They can just write a new password + salt in the db and get in as that user.

[ Parent | on HN ]

Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by ZoFreX on Wednesday September 26, 2012 @04:08AM (#4574653)

Well, we need to define the attack if we're going to talk about what will and won't help. Generally when we talk password security, we assume the attack is to discover a large number of users' passwords, not to spoof as one. Additionally, it's more common to get read-only access to the data than it is to be able to execute arbitrary queries against the DB.

[ Parent | on HN ]

Re:Data Breach Reveals 100k IEEE.org Members' Plaintext Pass... by shakesbeard on Tuesday September 25, 2012 @06:00PM (#4572916)

But maybe that's not want you want to achieve?

[ Parent | on HN ]