The Legitimisation of Have I Been Pwned
One of the examples he showed was a breach of a site that used "vBulletin" as the password encryption. I looked up what the hell this was and found this: https://www.vbulletin.com/forum/forum/vbulletin-sales-and-fe...It's basically MD5(MD5(password)+salt). It was unclear if the salt was global to the entire DB or different for every record.Surprise, yet another case of the blind leading the blind in PHP-land.