On: Steam loses user database

[buro9]

It's vBulletin 3.8.x

The passwords are hashed and salted using this:

    md5(md5(password + user_salt))

[knutae → buro9]

Running a hash function directly on a hash makes little sense. You probably meant:

    md5(md5(password) + user_salt)

[buro9 → knutae]

[edit]I'm wrong, you're right[/edit]

Just re-checked... the line is this:

    md5(md5($vbulletin->GPC['password']) . $vbulletin->userinfo['salt']))

I got confused by the last bracket closing an outer conditional.

[tommi → buro9]

Most likely they have another authentication backend.

[buro9 → tommi]

Not for Steam forums they don't, they're using vBulletin and it doesn't appear to be modified beyond the theme.

That Steam forums requires a separate registration shows that there is unlikely to be any integration between Steam and the forum software.

However their point is that if you used the same username and password on both the Steam forums and Steam itself (with likely the same username) then by virtue of Steam forums being compromised, your main account should be considered compromised.

[rmc → buro9]

Double MD5‼ To be extra secure‼