<story><title>Important Kickstarter Security Notice</title><url>https://www.kickstarter.com/blog/important-kickstarter-security-notice</url></story><parent_chain><item><author>zavi</author><text>If they describe how passwords were hashed, it would make it easier for hackers to crack them.</text></item><item><author>carbocation</author><text>From here forward, I will consider any disclosure involving stolen passwords that does not include a description of the password hashing&amp;#x2F;encryption&amp;#x2F;etc mechanism to mean &amp;quot;plaintext-equivalent passwords were taken&amp;quot;.&lt;p&gt;&lt;i&gt;Edit&lt;/i&gt;: Changed &amp;quot;plaintext passwords were taken&amp;quot; to &amp;quot;plaintext-equivalent passwords were taken&amp;quot;</text></item></parent_chain><comment><author>carbocation</author><text>&amp;gt; If they describe how passwords were hashed, it would make it easier for hackers to crack them.&lt;p&gt;I don&amp;#x27;t really agree with you.&lt;p&gt;If you store bcrypted stuff, you see $2a${integer exponent}$hash.&lt;p&gt;If you store SHA1&amp;#x27;ed stuff, you see characteristic hashes and can trivially test against known hashes. So on for MD5, etc.&lt;p&gt;I don&amp;#x27;t need you to tell me &amp;quot;we store SHA1&amp;#x27;ed stuff iterated 35 times with the following salt&amp;quot;, but keeping that information secret wouldn&amp;#x27;t usually help you anyway. A determined attacker will test and iterate until they&amp;#x27;ve figured out your scheme (or, if you&amp;#x27;re unlucky, they won&amp;#x27;t need to).&lt;p&gt;Telling the attacker &amp;quot;we bcrypted everything&amp;quot; doesn&amp;#x27;t tell them anything they couldn&amp;#x27;t plainly see on their own.</text></comment>
<story><title>Important Kickstarter Security Notice</title><url>https://www.kickstarter.com/blog/important-kickstarter-security-notice</url></story><parent_chain><item><author>zavi</author><text>If they describe how passwords were hashed, it would make it easier for hackers to crack them.</text></item><item><author>carbocation</author><text>From here forward, I will consider any disclosure involving stolen passwords that does not include a description of the password hashing&amp;#x2F;encryption&amp;#x2F;etc mechanism to mean &amp;quot;plaintext-equivalent passwords were taken&amp;quot;.&lt;p&gt;&lt;i&gt;Edit&lt;/i&gt;: Changed &amp;quot;plaintext passwords were taken&amp;quot; to &amp;quot;plaintext-equivalent passwords were taken&amp;quot;</text></item></parent_chain><comment><author>tptacek</author><text>No it doesn&amp;#x27;t. Attackers can obviously be presumed to have some number of password,digest pairs; for instance, for their own accounts. From that information it should be trivial to figure out the scheme used.&lt;p&gt;This of course leaves aside the fact that, having compromised any significant portion of the app, they are probably ε from source code anyways.</text></comment>