Re:LivingSocial Hacked – 50 Million Customers Affected
by StavrosK on Friday April 26, 2013 @04:56PM
(#5615427)
I like how everybody is optimistic.
It could have been MD5!
Re:LivingSocial Hacked – 50 Million Customers Affected
by integraton on Friday April 26, 2013 @05:32PM
(#5615647)
Since, AFAIK, it's built on Rails, that's unlikely. However, it's possible that it's SHA-1 since popular Rails auth solutions used that by default at the time the company was founded (2007), assuming that's what they started with and never switched from.
Re:LivingSocial Hacked – 50 Million Customers Affected
by ukd1 on Friday April 26, 2013 @05:51PM
(#5615712)
I'd be very surprised if Rails didn't support upgrading the hash over time - anyone know if it does with has_secure_password?
Re:LivingSocial Hacked – 50 Million Customers Affected
by integraton on Friday April 26, 2013 @06:22PM
(#5615852)
Prior to 3.1, Rails didn't have built-in support for password hashing or user auth beyond http auth, so it was handled by libraries (like devise or authlogic), generated code (such as with restful-auth, which was popular in 2007), or custom code. I don't think it's very common for legacy codebases to be migrated to has_secure_password, but it's not impossible. There is not built in migration for has_secure_password, AFAIK.
LivingSocial is a big enough company I wouldn't be surprised if their authentication code was all or mostly custom.
It's much more important to know what algorithm they were actually using, e.g. scrypt, bcrypt or PBKDF2, and what the settings/work factors/iteration counts for them are/were. If a company is reluctant to disclose that, they're likely using something that's highly vulnerable to parallelization/efficient brute force cracking, regardless of what kind or size of salt was used.