Please note that this thread is not a place to discuss the events of this weekend - once there's solid information to disseminate I'm sure that will be forthcoming - but instead this is to answer some questions I've seen repeated in email and IRC. Do try to avoid wild speculation and misinformation, and not bring up what so-and-so told you happened this weekend.
I've seen quite a few people question recent events, specifically when told there was a database breach and that passwords should be changed everyone asks, "But aren't they encrypted?" The answer is yes, of course they are. But that means nothing.
Passwords tend to be encrypted using what is called a "one-way hash"; this is a mathematical function where given a certain input, a specific output is generated. However, given the output, you cannot determine mathematically what the input to the function was - it only works in one direction. Some examples of one-way hashes are MD5, SHA1 and RIPEMD. See
this article for more on hashes.
Now, even though you can't mathematically determine what the input to a hash was, you can still "crack" it through other means. Some, such as MD5, have particular flaws that make it easier to calculate what the input was when given the hashed output, while for others there's the dictionary attack. For example, if my password was "p@ssw0rd", one possible hash of that is "A6.WLhKd.rk2M". While you may not easily be able to reverse that, what you can do is take every word of a dictionary (including variants, such as substituting 1 for i or l, 0 for o, etc) and hash that value to see what you get. Sooner or later, you're bound to find out that when using the input "p@ssw0rd" you get the same value. Now without cryptographically attacking the actual hash, you've defeated it because the password itself was weak.
If instead I had used "WA53@WaIOGxL;Qq" as my password.. well, yes you could eventually brute force that value and find that it matches the hashed output. But that's going to take a lot longer since the password itself is random. When cracking accounts, you'll get all the easy ones first - people who use their username as a password, or a common dictionary word, followed by those who prepend or append a number, change capitalization, or substitute some numbers and symbols for letters. So as you can see, it doesn't matter how strong an encryption algorithm is. If an attacker has your encrypted password, and you have a crappy password, and they know what method was used to encrypt it (which is usually the easiest part of the equation to get) then they can get your password. It's all a matter of how much CPU time they want to throw at the problem, and how patient they are to get your password as a result.
I invite and encourage any questions on passwords, encryption and security - I'll leave this topic here, even though it will quickly become "off topic" for the forum itself, until a few days have passed and those who would be interested in the idea have seen it here before moving it to the off topic board.
