Comment by spizzo
14 years ago
So what do you do past this point? I know you can probably rough out how much time it would take to find hash collisions and ask as your users to change their passwords before that amount of time elapses, but past that point, can't you no longer assume that it's the actual user logging in to change their password?
We performed a forced password reset on the users with compromised hashes. The old password will not work on Scribd, and those users will need to go through the password reset flow to regain access.
Ah ok. I was wondering how you verified the users' identity if the password was compromised. That makes sense, thanks!
We have reset passwords for all affected users. Hashes that got leaked are not useful now.
Well, that assumes people aren't reusing those passwords.
http://en.wikipedia.org/wiki/Salt_(cryptography)
3 replies →