Hacker News Reader

Comment by pmarreck | Hacker News Reader

One of the examples he showed was a breach of a site that used "vBulletin" as the password encryption. I looked up what the hell this was and found this: https://www.vbulletin.com/forum/forum/vbulletin-sales-and-fe...

It's basically MD5(MD5(password)+salt). It was unclear if the salt was global to the entire DB or different for every record.

Surprise, yet another case of the blind leading the blind in PHP-land.

View on HN

This may surprise some people, but doing stuff like MD5(MD5(password)+salt) was seen as a rather good way of storing passwords back in the day, and probably more secure than 99% of the password storage in 2005.

As I understand it, the problem is that many people use the same password on every forum. When they do this, an unscrupulous webmaster can use the hash to login as these members on other forums they post at. The double-hash in vB eliminates that potential issue and adds another layer of protection to forum members.

...

That's from 2005, and it's one of many forum software available at that time.

> There's a new release of PHP that adds several features, including a new sodium extension making PHP the first programming language to adopt modern cryptography in its standard library.

Surprise, yet another case of the blind leading the blind outside of PHP-land.

http://www.i-programmer.info/news/98-languages/11368-php-72-...

that thread was from 2005... 13 years ago... would you like to quote something a little more recent???

Sure. MtGox, a PHP site, got hacked just a handful of years ago because its creator decided to write his own encryption software.

got a source on that?

https://pirates-forum.org/Thread-Security-At-MtGox-Much-Wors...

which quotes the original source, which is now down but is still available at web.archive.org: https://web.archive.org/web/20140226001727/http://blog.magic...

Additional possible info: https://www.computerworld.com/article/2476003/cybercrime-hac...

Reply on news.ycombinator.com