Hacker News Reader

Comment by regnerba | Hacker News Reader

They sure liked repeating "secure encrypted infrastructure".

I was a little confused about the timeline of this as they mentioned implementing some functionality back in 2005. If I understand this right the specific issue of storing some (unsure as to what percentage or quantity) users passwords unhashed:

  - started in January of this year
  - is now fixed
  - were stored for up to 14 days in this state
  - would only effect new years signing up (based on it being part of the signup flow)

Do I understand that right?

View on HN

My interpretation was that unhashed passwords were stored for all users whose passwords were manually set by an administrator, from 2005 until some time very recently.

Looks like two issues were discovered.

1. All passwords set by admins for other accounts since 2005 were impacted. 2. Also all passwords starting Jan 2019 were also stored un-hashed for 14 days.

I have no inside info on this incident and haven't worked for Google in over 4 years, but the description of the 14-day 2019-only issue sounds like it would have affected only a subset of users whose data they included in a sample for troubleshooting purposes. The sample rate they use is probably far below 100%.

(Once again: this is speculation based on general firsthand knowledge about how Google operates, but I know nothing specific to this incident.)

Yes, of course. Not all but a different subset of passwords.

> They sure liked repeating "secure encrypted infrastructure".

Their audience is people who know those words and know that they want them, but might not know what they mean. Using technically accurate details when addressing people who don't understand the vocabulary is generally a recipe for misery.

Reply on news.ycombinator.com