News for hackers. Stuff that matters.

A comment on Linode hacked, CCs and passwords leaked. Parent comment

Re:Linode hacked, CCs and passwords leaked by tmcneal on Monday April 15, 2013 @03:26PM (#5553654)
To be fair the hacker didn't say the keys were stored on the same server as the credit card numbers, he said they were stored on the web server. It's most likely the database containing the CC numbers resides on a separate set of boxes than the web servers.
[ Parent | on HN ]
Re:Linode hacked, CCs and passwords leaked by danielweber on Monday April 15, 2013 @04:14PM (#5553995)
The Cigital-recommended way to hash your passwords is to use an HMAC/scrypt combo, with the HMAC key stored on the app server (not the database).

What Linode did may, or may not, be dumb. They are being tight-lipped so we can only guess.

[ Parent | on HN ]
Re:Linode hacked, CCs and passwords leaked by lawnchair_larry on Monday April 15, 2013 @05:32PM (#5554545)
Why would you use an HMAC for password storage? It's not like length extension attacks are relevant in that application.
[ Parent | on HN ]
Re:Linode hacked, CCs and passwords leaked by nenolod on Monday April 15, 2013 @04:09PM (#5553959)
the database server is local, read the entire log...
[ Parent | on HN ]