News for hackers. Stuff that matters.

A comment on Linode hacked, CCs and passwords leaked. Parent comment

Re:Linode hacked, CCs and passwords leaked by danielweber on Monday April 15, 2013 @04:14PM (#5553995)
The Cigital-recommended way to hash your passwords is to use an HMAC/scrypt combo, with the HMAC key stored on the app server (not the database).

What Linode did may, or may not, be dumb. They are being tight-lipped so we can only guess.

[ Parent | on HN ]
Re:Linode hacked, CCs and passwords leaked by lawnchair_larry on Monday April 15, 2013 @05:32PM (#5554545)
Why would you use an HMAC for password storage? It's not like length extension attacks are relevant in that application.
[ Parent | on HN ]