Mozilla accidentally posts usernames and password hashes

Mozilla has confirmed that a partial database containing usernames and password hashes belonging to users of addons.mozilla.org was mistakenly left on a public server.

As Sophos security expert Chester Wisniewski notes, Mozilla stored the compromised passwords set before April 9th, 2009 as MD5 hashes, rather than plain text.

"But MD5 has cryptographic weaknesses that permit creation of the same hash from multiple strings," he explained.

"This permits security experts to compute all the possible hashes and determine either your password or another string that will work even if it is not your password."

Fortunately, only a single individual - who was participating in Mozilla's web bounty program - managed to access the sensitive content.

Read more -here-

• Dropbox breach exposes customer credentials, authentication data
• Google: Passkey authentications top 1 billion across 400 million accounts
• FTC fines Razer for misrepresenting COVID masks as N95s
• FCC fines Verizon, AT&T other major carriers nearly $200 million for sharing customer data
• Federal regulators accuse Amazon executives of deleting messages
• FCC restores net neutrality rules