Hacker News Reader

Plaintext in 2015 ! Inexcusable.

Shouting "encryption" isn't a whole lot better really. You can use "military grade encryption" all you want, but if the server it is stored on has the keys there's extremely little point except the feel-good vibes.

The attackers stole legitimate login credentials. Encryption wouldn't help with that.

I run a bunch of websites which store bcrypted hashes of users' passwords. If you had my SQL login, you'd just find bcrypted hashes. It would absolutely prevent you from discovering their actual passwords in a meaningful amount of time.

You would, however, have plaintext copies of every piece of other sensitive information in that database.

Who cares is passwords are harder to brute force, once an attacker has walked away with everything in the OPM leak?

Don't get me wrong, I'm hugely in favour of hashed passwords. But with this sort of data it's a long way from making a complete database leak a nonissue.

I was responding to a comment about plaintext login credentials. I'm not claiming that bcrypting passwords somehow makes a database full of exquisitely private details somehow unimportant.

Reply on news.ycombinator.com