News for hackers. Stuff that matters.

A comment on Hack of Cupid Media dating website exposes 42 million plaintext passwords. Parent comment

Re:Hack of Cupid Media dating website exposes 42 million pla... by vidarh on Wednesday November 20, 2013 @08:16AM (#6767759)
> This step has concerns of its own though... for one thing the request itself reveals that the username/id is valid

Does it have to? Can you not have an implementation that always responds with a fake salt if the username is not valid?

[ Parent | on HN ]
Re:Hack of Cupid Media dating website exposes 42 million pla... by nly on Wednesday November 20, 2013 @08:31AM (#6767820)
Yes, or you can just use a deterministic salt like H ( service id || user id )
[ Parent | on HN ]