The Legitimisation of Have I Been Pwned
One of the examples he showed was a breach of a site that used "vBulletin" as the password encryption. I looked up what the hell this was and found this: <a href="https://www.vbulletin.com/forum/forum/vbulletin-sales-and-feedback/vbulletin-pre-sales-questions/134353-password-encryption" rel="nofollow">https://www.vbulletin.com/forum/forum/vbulletin-sales-and-fe...</a><p>It's basically MD5(MD5(password)+salt). It was unclear if the salt was global to the entire DB or different for every record.<p>Surprise, yet another case of the blind leading the blind in PHP-land.