News for hackers. Stuff that matters.

A comment on Slack was hacked. Parent comment

Re:Slack was hacked by richardlblair on Friday March 27, 2015 @03:16PM (#9278443)
The problem is that pacofvf's answer assumes you don't need to do this retroactively.

This would work if you were building a new system today, but if you had a DB full of one way hashes you're not going to be able to retroactively modify the pepper.

[ Parent | on HN ]
Re:Slack was hacked by richardlblair on Friday March 27, 2015 @03:20PM (#9278466)
And more importantly, slack straight up stated they salt the password and use bcrypt. It's all one way hashes, no encrypting/decrypting going on.
[ Parent | on HN ]