How the Bible and YouTube are fueling the next frontier of password cracking

nerd blaster wrote:http://arstechnica.com/security/2013/10/how-the-bible-and-youtube-are-fueling-the-next-frontier-of-password-cracking/

All of this is caused by developers being lazy and not salting passwords. You can't apply a dictionary attack to a password hash if the hash has an unknown string hashed in with it. Key stretching (bcrypt) and cryptographically secure random number generators for salts are the only way to prevent this properly. All the stuff is out there, and it's just plug and play these days. There's no excuse for weak password storage anymore.

The fact that they're using md5 instead of sha doesn't help either. I wouldn't say it's all laziness though. Most likely it's ignorance. After interviewing dozens of web developers I find about 1 in 5 is even aware of common web vulnerabilities like SQL Injection, XSS and CSRF so the fact that they don't know to salt their passwords doesn't surprise me.