Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> usernames, email addresses, session tokens and encrypted/salted versions of passwords

Wow, finally a breach where the hackers DIDN'T make off with all of our passwords in plain-text. Kudos to Twitter for actually handling passwords properly, considering the eventuality that all websites are vulnerable to attack.



I would feel better if I new how they handled passwords. Hopefully it is a hash and not encrypted. And hopefully that hash method is bcrypt (or something similarly painful to crack).


my first thought when reading the mail was exactly this: oh nice, salted and hashed but _how_?

I remember a time when many people assumed md5("notreallysalt"+password) was a good practice, and twitter is old.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: