My most shocking takeaway from this book was certainly discovering the extent to which GOOGLE relied on outsourcing security.
Google. Outsources. Security.
The kind of thing that makes it seem miraculous that any of it is still standing.
Google. Outsources. Security.
The kind of thing that makes it seem miraculous that any of it is still standing.
That said, I cannot recall Google ever having a breach, a la Yahoo, Sony, and basically most other companies. Does that mean everyone else should use who Google is using?
More likely they're just checking against the stolen passwords database whenever the user logs in, as passwords are typically submitted in plain text.
Mind you with salt and pepper (roughly, ways to modify the hash and overcome rainbow tables) checking anything other than the very highest frequency passwords found would seem onerous.