News for hackers. Stuff that matters.

A comment on Password hack of vBulletin.com. Parent comment

Re:Password hack of vBulletin.com by leapius on Monday November 18, 2013 @10:45AM (#6754805)
ugh, cos md5 squared is twice as secure as just once - why not md5 x 10 to be uber secure?
[ Parent | on HN ]
Re:Password hack of vBulletin.com by deskpro on Monday November 18, 2013 @10:58AM (#6754884)
if my memory is correct this is because they don't have access to $password; they get md5($password) from the client and to store that in the database with a salt need to run md5() again.
[ Parent | on HN ]
Re:Password hack of vBulletin.com by leapius on Monday November 18, 2013 @11:10AM (#6754951)
oh ok I thought the usual MO was:

if (md5(password + salt) == stored value) ..

[ Parent | on HN ]
Re:Password hack of vBulletin.com by Pxtl on Monday November 18, 2013 @12:14PM (#6755391)
It is, but if you don't have the naked password available at the time that you got your hands on the salt? May as well still salt it.
[ Parent | on HN ]