Hacker News Reader

Comment by lucb1e | Hacker News Reader

If I can say anything to the admins, it would only be that I very much appreciate being open and clear about it, and of course confirming that passwords were hashed. It was the only piece of personal information I had on the site.

Project Euler admins, thank you and good luck in resolving the matter.

Edit: Upvotes! Well if I can add to this message: so far 12 other people agree and want to wish you good luck as well it seems :)

View on HN

> Passwords at Project Euler are strongly encrypted using a one-way hash

This does not instill confidence. Hashes are not encryption. Furthermore there is an enormous difference between "we store your password as a single round of MD5" and "We use pbkdf2/scrypt to store your password".

Sure, but Project Euler is a labor of love, not a high volume e-commerce site.

It makes sense that they'd start with a hash and not change it for years. I'm not angry or surprised at this disclosure, and appreciate their honesty.

With a random salt otherwise rainbow tables are still "go", as it were.

My reading of that statement is that "Passwords are strongly encrypted" means that they are stored securly such that the cannot be 'decrypted' even by someone with access to the database. This phrase is intended for people without crypto knowledge who would not know what a one-way hash is. The "using a one-way hash" phrase is intended for people who do have this knowledge and clarifies that they are actually using a hash function, and that the previous statement was just a simplification for lay people.

Reply on news.ycombinator.com