News for hackers. Stuff that matters.

A comment on Scribd hacked – emails and hashed passwords leaked. Parent comment

Re:Scribd hacked – emails and hashed passwords leaked by smackfu on Thursday April 04, 2013 @12:47PM (#5493632)
Doesn't really matter, the password reset page leaks the same info and has presumably been up forever:

There is no account registered to mail '[email protected]'.

And that's a lot harder to fix.

[ Parent | on HN ]
Re:Scribd hacked – emails and hashed passwords leaked by endianswap on Thursday April 04, 2013 @01:02PM (#5493708)
Why is that harder to fix? Many sites handle it properly:

"If there was an account associated with that email address we have emailed it with instructions."

[ Parent | on HN ]
Re:Scribd hacked – emails and hashed passwords leaked by smackfu on Thursday April 04, 2013 @01:06PM (#5493740)
Since people log in with a username, not an email, they may not know which email address they associated with the account. Especially if they used a one-off to avoid spam. Personally, I prefer systems that do a reset to email after you provide a username, since usernames are often public / verifiable anyways.
[ Parent | on HN ]