Well even if the breech wasn't an attack via account compromise. The fact is the password hashes were STOLEN. And, they CAN be decrypted with the proper tools, time and effort. Although it would need to be a targeted attack for a certain member to go that far.
As for encryption, SHA1 should be used and I would've though vB5 would have it. Guess one more thing that IB failed at once again....
If the hashes are stolen then the hash function used is irrelevant as with modern graphics cards being used for processing power over a couple of machines brute forcing is not a particularly arduous task, especially as most people do not actually have very good passwords.
Just as a note SHA1 is not considered secure and is recommended to be discontinued by NIST. NIST, in a competition held a couple of years back, selected a new hash function to be SHA3 as SHA2 was no longer deemed to be secure enough for long term use and should not be used as of 2010.
11-26-2013, 02:13 PM
Threaded Mode