News for hackers. Stuff that matters.

A comment on Slack was hacked. Parent comment

Re:Slack was hacked by elchief on Friday March 27, 2015 @03:53PM (#9278630)
It can help in the following scenarios:

1. Hacker steals db but does not compromise web servers (because the hmac pepper key lives on the web servers and not in the db)

2. Hacker can run SQL Injection via web server, but cannot otherwise access web server memory/process

3. HMAC key is stored in a hardware security module and hacker cannot gain physical access

[ Parent | on HN ]
Re:Slack was hacked by xorcist on Friday March 27, 2015 @05:20PM (#9279072)
All of the above cases are also helped by just by regular symmetric encryption. Why make things more complicated than necessary?
[ Parent | on HN ]
Re:Slack was hacked by elchief on Saturday March 28, 2015 @01:24PM (#9282083)
How is HMAC more complicated than encryption?
[ Parent | on HN ]