At Blind, a security lapse revealed private complaints from tech employees
This bothers me:<p>&gt; The database also contained passwords, which were stored as an MD5 hash, a long-outdated algorithm that is nowadays easy to crack. Many of the passwords were easily unscrambled using readily available tools when we tried.<p>That&#x27;s not how hash functions work...<p>&gt; Kim denied this. “We don’t use MD5 for our passwords to store them,” he said. “The MD5 keys were a log and it does not represent how we are managing data. We use more advanced methods like salted hash and SHA2 on securing users’ data in our database.”<p>This sounds much more likely.<p>&gt; (Logging in with an email address and unscrambled password would be unlawful, therefore we cannot verify this claim.)<p>So, they directly claim that weakly hashed passwords were available (and unscramble-able, apparently??), but they&#x27;re unable to prove this and they&#x27;re ignoring the company&#x27;s reasonable explanation. Great reporting.