

Fortunately passwords appear to have been strongly hashed


NVIDIA suspended operations of the NVIDIA Forums ( last week.



  • username
  • email address
  • hashed passwords with random salt value
  • public-facing "About Me" profile information






[Image Source: NVIDIA Wallpapers]





Source: NVIDIA Forums

Comments     Threshold


By andrewaggb on 7/14/2012 10:21:08 AM , Rating: 2
I think the article is a bit unfair to compare this to yahoo's. It does mention the passwords were hashed with random salts, but in my opinion the yahoo system had no place being used on the internet period. It's totally irresponsible.
Nvidia used hashed passwords and a random salt, which is about the best you can do right now. Quite a difference.

SQL injection is preventable as others have pointed out, so it's still bad, but it's alot easier to be unaware you have a sql injection vulnerability than to be unaware you have plain text passwords.

Anyways, I got an email from nvidia yesterday...

By Etsp on 7/14/2012 3:38:04 PM , Rating: 2
At this point, it really depends on the hash used. All a salt does is prevent the use of rainbow tables.

If it was MD5, these passwords have been decrypted, salt or no salt.

If it was a single pass of SHA512, then, maybe some of them can be decrypted in the coming months.

If it was .1 seconds worth of computation time on an average CPU (1000+ passes of SHA512 hashing), the passwords are likely safe for a few years.

By erple2 on 7/15/2012 12:21:56 PM , Rating: 2
I used to think that. But then I read up something Jeff Atwood posted...

Ultimately it depends on how the nvidia forums hashed their password. SHA512 isn't really safe, and neither is salting. If hackers gained the password db, it's a good bet they might also have gained the salt values, which makes salting worthless. Given the speed at which modern (and ironically, NVidia) GPUs can process most hashing algorithms, it's only a matter of less time than you think of hacking. The only security you have, then, is making a gigantically long password.

