News for hackers. Stuff that matters.

A comment on Password hack of vBulletin.com. Parent comment

Re:Password hack of vBulletin.com by code_duck on Monday November 18, 2013 @09:56AM (#6754541)
If tech journalists would use the right terms that would at least help lead the public towards a better understandings of this issue. I presume they say 'encrypted' as their generally means 'not plain text' to the lay person. To be fair, we do call these cryptographic hashes.

By the way, if anyone is wondering how VBulletin forums store passwords... It's md5(md5(password)+salt).

[ Parent | on HN ]
Re:Password hack of vBulletin.com by leapius on Monday November 18, 2013 @10:45AM (#6754805)
ugh, cos md5 squared is twice as secure as just once - why not md5 x 10 to be uber secure?
[ Parent | on HN ]
Re:Password hack of vBulletin.com by deskpro on Monday November 18, 2013 @10:58AM (#6754884)
if my memory is correct this is because they don't have access to $password; they get md5($password) from the client and to store that in the database with a salt need to run md5() again.
[ Parent | on HN ]
Re:Password hack of vBulletin.com by leapius on Monday November 18, 2013 @11:10AM (#6754951)
oh ok I thought the usual MO was:

if (md5(password + salt) == stored value) ..

[ Parent | on HN ]
Re:Password hack of vBulletin.com by Pxtl on Monday November 18, 2013 @12:14PM (#6755391)
It is, but if you don't have the naked password available at the time that you got your hands on the salt? May as well still salt it.
[ Parent | on HN ]