Hacker News Reader

I think at this point it should be standard practice to say what hashing algorithm is used in passwords when disclosing a breach.

The email I got from quota just says “encrypted” passwords, and while the blog post says “hashed”, it doesn’t say what algorithm. For all we know it could be something useless like MD5

View on HN

This comment should be voted to the top of the conversation. "Hashed" means absolutely nothing these days.

It'd be useful in the sense that you'd be able to warn others, but for your own password you should be using a password manager with auto generated random passwords. That way the only thing you need to do is change one password on the leaked site.

That's exactly my point. I use 1password to handle my logins, but most people I speak to use the same password for everything, so knowing how likely it is that other services could be compromised due to this is vital.

Reply on news.ycombinator.com