Important Kickstarter Security Notice

Re:Important Kickstarter Security Notice by sjm-lbm on Saturday February 15, 2014 @05:03PM (#7245570)

Thanks for your transparency, but can you be more specific about when the switch from SHA-1 to bcrypt occurred?

If it was 6 (or more) months ago, then I think you'll find at least some sympathy here - "break things" sometimes happens after "move fast," and I'm sure we've all put some code in production that, in retrospect, we wish we hadn't. However, your statement is still technically correct if the switch to bcrypt happened late this week (ie, after the breach was made known to Kickstarter), and that worries me.

[ Parent | on HN ]

Re:Important Kickstarter Security Notice by tptacek on Saturday February 15, 2014 @05:31PM (#7245725)

This is about as reasonable as asking whether they got hacked a year ago, did nothing, and didn't tell anyone. Only now do they tell us that law enforcement informed them. Read between the lines, man. Inhales.

[ Parent | on HN ]

Re:Important Kickstarter Security Notice by sjm-lbm on Saturday February 15, 2014 @06:15PM (#7245896)

Ha, fair enough - that statement was excessively cynical. Thanks for being a voice of reason on this issue.

[ Parent | on HN ]

Re:Important Kickstarter Security Notice by tptacek on Saturday February 15, 2014 @06:16PM (#7245902)

Thank you for taking my snippiness in the constructive spirit I now rationalize it as being intended in. ;)

[ Parent | on HN ]