LinkedIn admits passwords were stored unsalted

I wonder if they know how those particular hashes that were leaked got stolen, if not, they should assume the whole database was stolen and only some of it has been leaked publicly, thus necessitating that this action be taken for all users accounts, not just the ones that match the hashes in the leak.

> It is worth noting that the affected members who update their passwords and members whose passwords have not been compromised benefit from the enhanced security we just recently put in place, which includes hashing and salting of our current password databases.

Huh? For people who change their password, fine, but 'for members whose passwords have not been compromised', how are they re-hashing them with salt unless they have the original (plaintext) passwords on file. Or are they doing H(salt + H(pass)), rather than H(salt + pass)?

If the latter, then hopefully they are at least re-hashing your password next time you log in, but most people don't log in very often - my cookies certainly haven't been expired. A co-worker tells me that even after changing his password through the website, the login credentials on the Android app were not expired!

If we presume that the 6.5m password dump was the past version, it shows that they just hashed the passwords before. This sentence (if I'm interpreting correctly), indicates that they were plaintext and were recently changed from plaintext to hash(salt+password).

I must be missing something in my interpretation though, because there isn't any evidence that they had the plaintext passwords to begin with.

(My assumption is that he means any user that has recently logged in was transparently moved to the hash(salt+password) scheme they are using now and previously just had hash(password) in place.)