There's a bit more info in this one about exactly what was compromised though. While I can understand the abundance of caution in resetting passwords despite only hashes and salts being lost, it is odd that they would "[presume] the attackers may be able to decrypt the passwords," assuming they're using strong encryption.
I wouldn't call resetting passwords an "abundance of caution" in this case. It's very likely that the attackers are able to retrieve passwords when they have the SHA1 hash and the salt (not exactly by decrypting though).
"In late April, the UserVoice security team learned that an unauthorized party illegally accessed one of UserVoice’s backend reporting systems and was able to view user data on a small subset of users. The user data includes name, email, and a hashed password and salt. Unfortunately, the passwords were hashed with the SHA1 hashing algorithm, which by today’s standards is considered weak. As such, we’re resetting the passwords for all users in our database."
[+] [-] tempestn|9 years ago|reply
There's a bit more info in this one about exactly what was compromised though. While I can understand the abundance of caution in resetting passwords despite only hashes and salts being lost, it is odd that they would "[presume] the attackers may be able to decrypt the passwords," assuming they're using strong encryption.
[+] [-] runesoerensen|9 years ago|reply
Here's a good blog post how and why this is problematic: https://www.troyhunt.com/our-password-hashing-has-no-clothes...
[+] [-] RossP|9 years ago|reply
Further information: https://status.uservoice.com/incidents/fb7ml8b3nphf
[+] [-] nacs|9 years ago|reply
Apparently I'm part of the "0.001%" that was affected in the breach.
[+] [-] tempestn|9 years ago|reply
[+] [-] nsgf|9 years ago|reply