Slack was hacked
I hate to be the negative guy, and they were hashing passwords better than 90% of the sites, but it would be SO easy to completely neutralize password leakage when the attacker only has access to the database.<p><a href="https://blog.filippo.io/salt-and-pepper/" rel="nofollow">https://blog.filippo.io/salt-and-pepper/</a><p>tl;dr: Hardcode a second salt in your application code or in an environment variable. Then a database dump is not enough anymore to do any kind of bruteforce.<p>It's simple, free and you can retroactively apply it.<p>EDIT: I addressed some of the points raised in this thread here <a href="https://blog.filippo.io/salt-and-pepper/#editedtoaddanoteonrotation" rel="nofollow">https://blog.filippo.io/salt-and-pepper/#editedtoaddanoteonr...</a>