Adobe says that they've followed best practices for password storage and protection for more than a year now...
13 generations of photoshop
...and they're just getting around to this after CS6?
13 generations of photoshop
...and they're just getting around to this after CS6?
Adobe refused to patch a vulnerability in CS5 at one point, telling people to purchase and upgrade to CS6 (US$199) if they wanted to not be vulnerable to malicious code execution. In response to the uproar they eventually backported the patch.
[0]: http://www.macworld.com/article/1166779/adobe_will_issue_fre...
The reason Photoshop consolidated itself: first mover advantage. Everybody else is playing catch
Now, in the "the company is paying" field, yes, standards are rock-bottom, or even lower. But I don't think PS gets so low.
HW companies do not know how to do SW.
(I ask this as a fairly big fan of bcrypt myself. Somehow I just have the impression that half the peanut gallery comments come from people who literally switched over from md5 hashes yesterday and suddenly feel the need to crow about their great accomplishment.)
Unix has been using salted hashed passwords since the 70s. "one-way hash function" is a common phrase in the first edition of Applied Cryptography published in 1994. http://books.google.com/books?q=isbn:0471597562
(the discussions usually then fragment into the "No, use scrypt instead! GPUs! HashCat! ASICs! Memory-hard vs iterations-hard!" thread, and the "but what if I use an application salt with my MD5 hashes? Or invent my own complification techniques (and keep using MD5)?")
If Adobe didn't switch to intentionally-slow hashes with proper salting until "last year", that puts them over 20 years behind "best practice" (as well as 2 or 3 years behind fully deserving of online mockery, laughable uninformed-newbie levels of security engineering).