The FBI stole an Instapaper server in an unrelated raid
Instapaper stores only salted SHA-1 hashes of passwords, so those are relatively safe.<p>--<p>Obligatory statement on <i>NEVER USING SHA-1 HASHES</i> to make passwords "safe".<p>Any normal person can brute force millions of SHA-1 hashes (salted however much you want) per second on a GPU.<p>If the FBI so wanted (although I don't believe they do) I'm sure they could brute force almost every single password in that database. Granted, it's the government and they have better ways of obtaining such information, but if there is someone the FBI is watching on Instapaper's databases and they so wanted, storing the SHA-1 hash of the password all but handed them over to the FBI.<p>I am now glad my Instapaper password was generated randomly, 16 characters long, and I will now change it just to be safe.<p>For anyone running a database which stores ussername/passwords, take a look at bcrypt or scrypt. They're millions (no, I am not exaggerating) of time better than SHA-1.<p>(Edit: Grammar)