Hacker News Reader

That's a nice summary. One thing I'm curious about is:

> Data includes usernames and hashed passwords

How are they hashed? And specifically, can we expect them to be already cracked?

Yes, in particular we need to know algorithm, work factor and salting details to know whether or not the passwords may be compromised.

Just assume that it's compromised and generate a new one. There is no point in wasting time trying to estimate how long it might take someone to crack it.

It matters at lower extreme. If it was something trivial and people shared the password with another account, then they may be already compromised. If it was hard and salted per-user, they still have to change it, but the chance of compromise on other services is significantly lower.

It may also explain some suspicious behaviour / source of compromise in the past (we know when the issue was uncovered, not when the first dump was taken)

Reply on news.ycombinator.com