Adobe User Accounts - HACKED!!!

[Kym]

It gets worse... http://it.slashdot.org/story/13/11/0...ted-not-hashed

Bottom line the hacked passwords were encrypted not hashed.

Why does that matter?
Brute force attack can unencrypt the passwords giving the hackers the original password in plain text whereas a hashed password is much harder to find the original password.
If you use the same password on multiple sites then the hacker has your password for those other sites.

[ricktas]

and in more news from Adobe:

1.9 million people had used '123456' as their Adobe password. Half a million had used 123456789, and an equally idiotic of 350,000 had used 'password'.

If people are silly enough to do this, even I could hack their accounts!

[arthurking83]

If that was the case .. the simple passwords used, then the most likely method of password cracking would have been brute force.
So I'd suspect that if a proper Adobe account holder had used a proper password, then brute force attempts at getting into these accounts may have been both slower or even futile.

I'm thinking that if this is the sort of user account that was hacked, that many of those accounts were either dummy accounts(maybe not used or simply just set up because you have too) and so not a major issue for a legitimate account holder to worry too much about.

Of course the database shouldn't have been entered into at all, so major bad on Adobe's part there and inexcusable really.

A recent news item on the topic had it that well over 100 million(150 million?) accounts were hacked too .. not the 1 million, or 38 million previously thought to have been broken into.

[ricktas]

Another bit of information:

The file that was obtained by the hackers was 9.3GB. That is a LOT of user account data.

[bricat]

"If you use the same password on multiple sites then the hacker has your password for those other sites.[/QUOTE]

So then they have to read my mind to guess what other sites I access? I don't think I have much information on any site that it would matter, but we trust these sites we access to have good security. Some are better than others or more importantly perceived by hackers to be a "target" for information.

[Kym]

So then they have to read my mind to guess what other sites I access? I don't think I have much information on any site that it would matter, but we trust these sites we access to have good security. Some are better than others or more importantly perceived by hackers to be a "target" for information.

Not you specifcally, but using the hacked account data to have bulk probe attempts at banking and other sites.
Turns out that computers are very good at doing the same thing over and over very quickly.

Once the probe software finds lots of accounts then feeds that info back to the crooks when then start ID theft etc.