1. Yes
2. Yes<p>AM took the unencrypted password, lowercased it, and hashed it into an MD5 token that they then stored - conjecture is that it was used as a login token. That is what the article indicates was cracked, since MD5 is very weak, to get a lowercased password, then tried every permutation of capital letters on the bcrypted passwords, to get the actual passwords out.<p>To avoid similar issues, if you generate a token, don&#x27;t use the unencrypted password as part of it. Random tokens are fine.