Hacker News Reader

> usernames, email addresses, session tokens and encrypted/salted versions of passwords

Wow, finally a breach where the hackers DIDN'T make off with all of our passwords in plain-text. Kudos to Twitter for actually handling passwords properly, considering the eventuality that all websites are vulnerable to attack.

View on HN

I would feel better if I new how they handled passwords. Hopefully it is a hash and not encrypted. And hopefully that hash method is bcrypt (or something similarly painful to crack).

my first thought when reading the mail was exactly this: oh nice, salted and hashed but _how_?

I remember a time when many people assumed md5("notreallysalt"+password) was a good practice, and twitter is old.

Reply on news.ycombinator.com