<story><title>Zappos.com customer database compromised</title><url>http://www.zappos.com/passwordchange</url></story><parent_chain></parent_chain><comment><author>IgorPartola</author><text>LastPass FTW! The attacker will reverse my password just to find a bunch of unusable bits :). What would be even cooler is an API on top of LastPass that sites like Zappos could hook into to force a behind-the-scenes change of passwords, similar to revoking a compromised certificate. Essentially, since there is some lead time after the breach is discovered and before the attacker manages to crack the long, random passwords, their efforts would be futile by the time they are done since all LastPass passwords would have already been changed.&lt;p&gt;Or we could just stop using passwords everywhere and not have this problem again. Anybody? Anybody?&lt;p&gt;Disclosure: I have no affiliation with LastPass beyond being a satisfied user.</text></comment>
<story><title>Zappos.com customer database compromised</title><url>http://www.zappos.com/passwordchange</url></story><parent_chain></parent_chain><comment><author>jjacobson</author><text>Zappos developer here. I&apos;ll answer any questions that I legally can or help get customer problems passed onto people that can help.</text></comment>