GitHub Raises $250M at $2B Valuation

Re:GitHub Raises $250M at $2B Valuation by bigiain on Wednesday July 29, 2015 @11:37PM (#9973055)

It will help when my unique password get exposed through any of the many likely routes that don't give the attacker complete code execution on the servers - SQLi or using XSS to steal admin tokens for example.

[ Parent | on HN ]

Re:GitHub Raises $250M at $2B Valuation by homakov on Thursday July 30, 2015 @06:33AM (#9974101)

Interesting, sqli that works only for reading encrypted_hash from DB? But since password is unique it cannot be bruteforced even locally.

[ Parent | on HN ]

Re:GitHub Raises $250M at $2B Valuation by bigiain on Thursday July 30, 2015 @08:41PM (#9979254)

True - it's the (many many documented[1]) cases where the SQLi grabs the password_cleartext column, not the encrypted_hash one that worry me here.

[1] http://plaintextoffenders.com/

[ Parent | on HN ]