this post was submitted on 10 Jul 2023
3286 points (99.3% liked)
Lemmy.World Announcements
29042 readers
3 users here now
This Community is intended for posts about the Lemmy.world server by the admins.
Follow us for server news ๐
Outages ๐ฅ
https://status.lemmy.world
For support with issues at Lemmy.world, go to the Lemmy.world Support community.
Support e-mail
Any support requests are best sent to info@lemmy.world e-mail.
Report contact
- DM https://lemmy.world/u/lwreport
- Email report@lemmy.world (PGP Supported)
Donations ๐
If you would like to make a donation to support the cost of running this platform, please do so at the following donation URLs.
If you can, please use / switch to Ko-Fi, it has the lowest fees for us
Join the team
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Passwords were leaked?
No, just browser session tokens if you loaded the site during the hack. And the tokens were reset after the site came back up.
Databases don't store passwords to begin with so passwords can't really be leaked. They store a hash of your password. So if your password is of sufficient length it could take 100s or 1000s of years to find a match to the hash. If you have a really short password or if the hash is using an insufficient hash algorithm then there exist these things called rainbow tables which are a list of every hash and it could simply be looked up what your password is.
Not all software developers follow those guidelines - either out of laziness or incompetence. Plenty of sites/companies have had password leaks due to improper storage. The best way to protect yourself is to use unique passwords for all accounts.
Probably not, it seems only temporary "session" cookies (JWT) were leaked for those affected, so they were revoked for everyone. If you wanna feel safer, changing your password is a good idea "just in case".
Based on what I read I'd say no. XSS usually just affects browsers or anything that runs JS so it mainly affects the client side. JWTs don't (if following the spec) contain passwords, it's just a short lived token that identifies someone. If you sent your password as a DM you're dumb, and they got your password if they compromised your account.