Gawker Media hacked

Gah... The problem here is that this likely won't hurt Gawker very much. It will, however, hurt the people whose accounts were compromised. Gawker was asking for it; they weren't.<p>I don't support the crackers here, but I do have to admit to a little schadenfreude at seeing Gawker get taken down a peg. Not only are they a worthless tabloid, but they're dicks about it, too.

Here is the list of Gawker passwords along with MySQL, FTP accounts <a href="http://pastebin.com/9rRmf6W5" rel="nofollow">http://pastebin.com/9rRmf6W5</a><p>Thousands of people still use "password" as their password.

Holy page views, Batman!<p>Screenshot from Quantcast showing 409M page views, 31.4M visitors a month in aggregate for all Gawker Media properties<p>"My job was to write twelve posts a day about 'media gossip,' which meant anything unpleasant or otherwise intriguing about anyone who had power in any Manhattan culture industry. There had to be enough posts so that whoever was sitting at my old desk at the publishing house, and everyone in Manhattan like her, could read something new when boredom struck."<p>Excerpt from book by Emily Gould, ex-Gawker, infamous blogger

And now it's been released on TPB <a href="http://news.ycombinator.com/item?id=1998642" rel="nofollow">http://news.ycombinator.com/item?id=1998642</a>

<a href="http://gawker.com/5712646/advisory-notice-no-action-required" rel="nofollow">http://gawker.com/5712646/advisory-notice-no-action-required</a><p>is this a joke or what? I never do understand gawker.

Contrary to Gawker's claim, the Unix standard hash function crypt(3) has been crackable since at least 1990. It is salted, by the way.

Whoever attacked threw up a torrent of Gawker's stuff. On one hand, Gawker Media has been asking for something like this with their somewhat arrogant coverage of late (iPhone 4, Brett Favre, Christine O'Donnell, etc.). On the other … a million users getting their passwords hacked is VERY bad form.

Amazing how quickly the comments on that post degraded, especially over a question that deserved to be asked.

So I take it they just hashed and didn't HMAC. Was it just plain old MD5(password)?<p>Unrelatedly, does HN HMAC?