Original URL: https://www.theregister.com/2010/12/28/mozilla_password_snafu/
Mozilla exposes 44,000 passwords
'Old, inactive, and harmless'
Posted in Security, 28th December 2010 19:04 GMT
Mozilla inadvertently exposed the passwords of 44,000 inactive addons.mozilla.org accounts, but says there's nothing to worry about.
"On December 17th, Mozilla was notified by a security researcher that a partial database of addons.mozilla.org user accounts was mistakenly left on a Mozilla public server," Mozilla's director of infrastructure security Chris Lyon wrote in a posting on the Mozilla Security Blog late Monday night.
Although that exposure may seem a wee bit scary, Lyons notes that all the passwords were for inactive accounts, that Mozilla was able to account for every download of the database, and that the password hashes were of the "older md5-based" variety, and that they all have now been deleted, effectively disabling those accounts.
"All current addons.mozilla.org accounts use a more secure SHA-512 password hash with per-user salts" since April 9, 2009, Lyons said. "It is important to note that current addons.mozilla.org users and accounts are not at risk."
Mozilla informed all affected users of the slip-up by email, prompting one Larry Seltzer to add a comment to Lyon's post, saying: "I got the e-mail a while before this blog post or anything else about the matter was on the web. The e-mail looked legit, but..."
Ah, Mr. Seltzer, we know the feeling. ®