szymanskicolleen wrote: »

I got the email about the MFP privacy breech. Is anyone concerned about it?

@szymanskicolleen. MFP are doing the appropriate "duty of care" in informing people of the security breach.

As for whether this of major concern is a different matter (part of my professional life involves IT security).

What was stolen includes one-way hashed passwords with salt. The way a password is determined as correct is that the entered password has the users salt data added then processed by the one way hash process. The resultant binary data is compared against the users stored binary password data and if matched, then the login is successful.

What this means is that the password cannot be retrieved without a brute force attack (ie. running it against a dictionary). The salt means that even if 2 users have the same password, the one-way hashed password result is different. Each password must be checked against each attempt with salt added. This makes orders of magnitude harder (and often not worth the effort, even if the cracker can do in excess of 10,000 passwords attempts per second - and yes some can). The longer and more involved your password (upper/lower case, numbers, special characters), the less likely it is to be able to be decrypted even by a brute force attack.

A full brute force attack on a hard to guess 8 character password with numbers, special characters, upper and lower case that can check 1,000,000 passwords per seconds would take on average 1100 *YEARS*. With the salt this is to do *ONE* users password. Each extra character cumulatively multiplies this timeframe by about 100.

As there is no financial data listed as stolen, there is not enough data stolen to conduct identity theft. At worst if your email password is the same as your MFP password *AND* your MFP password was easy to guess, then MAYBE you may be of enough interest to have an issue.

As a precaution, change any password that is the same as your MFP password that is associated with your email address AND change your MFP password.

The biggest coup from the hackers standpoint is the email addresses matched with names. This can be sold as an interest list to spammers (people interested in weight management). With the names added to the email address list, it increases the chance the spammers can get through the spam filters of your email supplier (personally addressed mail has a MUCH higher chance of getting through).

Beyond this there is little cause for concern.