Nice post. luckily I don't sign up for every site I visit often. I only do so when I am interested in receiving information from them and that is not often. I try to keep my passwords hard to figure out but also easy for me to remember so I use combinations I know I can remember.

I tried using those password creation programs like lastpass that create very difficult to figure out and remember passwords and it became a problem when I didn't have access to lastpass and could not access my emails or sites because the passwords were just waaaay to complicated to remember.

My password system is fine for me. I simply steer clear of the usual passwords that some idiots out there use line 123456 or password.

most sites store your password as a hash - so that it cannot be reversed - and why they cannot give it to you should you forget it.  I am surprised that gawker did not store them that way.  That is lazy and stupid.

The damage would only have been "smaller" were that the case, hashes would not protect you. Obviously DES is outdated, but if people have such shitty passwords as 12345 then I wouldn't even need to run bruteforce checks against the hash if I had the source as well (which they did).

Edit: just to be clear. If you store passwords as hashes then there is no need to reverse it anyway, all you need to do is come up with something that produces the same hash, as the source cannot tell the difference.

Person enters email address.

Site response - "Nope, you didn't get gawkered"

Person breathes sigh of relief.  "Well, I didn't get hit so I don't have to change my password, thank gosh, because I like using the same password on every site I got to since it's easier for me to remember and I also don't have to have, like, a billion sticky notes hanging around my computer with all the different passwords on them."

Meanwhile, behind the facade of this innocent looking bookstore, "hey, another dummy put their address in, lets see what we've got..."

DES is easily cracked.

No problem here as I've never visited either one let alone give any info out. Good heads up though to those who have. Gawker imo is a weird name.

Crap, I've been gawkered! Thanks Doc, now to go change my password!

You're welcome, karmat!

This post would have been worth it anyway....but knowing it helped you makes it extremely gratifying.

DES is encryption, not a hash.  MD5 is the weaker of the 2 most popular ones, SHA-1 being the better of the 2.  Encryptions are susceptible to decoding, HASHes are not since there is no way to get back to the original string.

Which is the same as brute force - which everything is susceptible to - given enough time.