<story><title>Important Kickstarter Security Notice</title><url>https://www.kickstarter.com/blog/important-kickstarter-security-notice</url></story><parent_chain><item><author>mecredis</author><text>Hi! I work at Kickstarter. To answer everyone&amp;#x27;s question regarding the encryption used for our passwords: old passwords used salted SHA1, digested multiple times. More recent passwords use bcrypt.</text></item></parent_chain><comment><author>itafroma</author><text>I see that when I log into Kickstarter, there&amp;#x27;s a banner that recommends changing my password. That&amp;#x27;s pretty good, but why not take it a step further by invalidating all the passwords and forcing a password change when someone logs in?</text></comment>
<story><title>Important Kickstarter Security Notice</title><url>https://www.kickstarter.com/blog/important-kickstarter-security-notice</url></story><parent_chain><item><author>mecredis</author><text>Hi! I work at Kickstarter. To answer everyone&amp;#x27;s question regarding the encryption used for our passwords: old passwords used salted SHA1, digested multiple times. More recent passwords use bcrypt.</text></item></parent_chain><comment><author>r0muald</author><text>Why resetting passwords is an optional step left to users? Wouldn&amp;#x27;t it be more rational to reset all passwords?</text></comment>