Mozilla accidentally posts usernames and password hashes
tgdaily.com
tgdaily.com
I don't know how long it will take for people to figure this out. SHA-512 with a salt is not the right way to store passwords. Yes, it's better by leaps and bounds than storing the plaintext. Yes, it's better than crypt(3) as gawker used. But come on, just use bcrypt already.
And the fact that they calls SHA-512 with salts "invulnerable" ... I don't even know what to say to that.
Here's a link to the original blog post: http://blog.mozilla.com/security/2010/12/27/addons-mozilla-o...
I guess it makes sense that the media would call something like that invulnerable though, they don't know anything about it anyways.
Still, other hash functions such as the SHA512 they are currently using are also wildly inappropriate, as explained in the following excellent post: http://codahale.com/how-to-safely-store-a-password/