Hacker News Reader

WTF, A YEAR AGO ?? They didn't notify users (i.e. me). Aren't they in breach of California law? Where are they based?

maybe they're just learning about it

there also was a leak around 5(!) years ago, didn't bother them to do something about it though :/

see http://news.ycombinator.com/item?id=4083339

Nice to hear. I had thought that perhaps one of their higher-ups had used the same pass on LinkedIn as on Last.fm and had noticed suspicious activity. Now I know that they just googled to see, "oh, did anyone hack us? they did?! OVER A YEAR AGO?!"

Any info on how and why so many were cracked? Passwords too simple?

MD5, unsalted. On commodity hardware you can compute those blazingly fast. A brute force attack, ignoring word lists, is totally possible.

That's ignoring all the resources that offer access to precomputed hashes (I don't want to call a list of MD5 hashes a rainbow table).

Easy or not, passwords saved with this scheme are unprotected.

Unsalted MD5s. http://www.codinghorror.com/blog/2012/04/speed-hashing.html