> Even though this information was accessed, the passwords stored by Evernote are protected by one-way encryption. (In technical terms, they are hashed and salted.
Were the attackers ables to access the salt ?
Were the attackers ables to access the salt ?
A hidden salt that is used across all passwords is useless on a public service, because that becomes the password to hack.
The attacker takes an account that has a known password and brute forces the salt from that.
Salt and hash are good for protecting well chosen passwords, but because the speed they can be processed mean the hacker can try billions of different passwords a second. These days choosing a cryptographically hard (memory hard) is the best bet to extend the time from a breach to password discovery so the majority of the users can change their password.
pbkdf2_sha256$10000$rdfyoPhMNhnC$3QEJ9hp0Qe68/p8+b1tVsYmNqVHiFrhmpWizXq+xQoo=
algo $ iterations $ salt $ hash
But to answer your question: I'm not sure, but probably.