How Companies Can Beef Up Password Security
Summary: Separate password breaches at LinkedIn, eHarmony and Last.fm exposed millions of credentials, prompting Krebs to interview Matasano Security researcher Thomas H. Ptacek on why companies keep getting password storage wrong. Ptacek argues the problem is not SHA-1 versus SHA-512 or salting but the use of fast cryptographic hashes instead of deliberately slow password hashes like Bcrypt, which can cut cracking from tens of thousands of guesses per second to tens.
Why it matters: Ptacek estimates that of a hypothetical 10 million stolen Bcrypt hashes, only tens or hundreds of user passwords might be compromised, versus roughly three million cracked in the LinkedIn dump - the difference between a contained incident and a mass credential leak.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026