negasoratwiikuuHashed passwords remain safe for a finite period of time after a compromise because the actual password isn't stored anywhere, and the only way to get in is to crack it using a large amount of computer power.
https://twitter.com/cybertillie/status/1445839064733790208
Show Contentlol
All this code shows is that all the passwords are stored with bcrypt now. Before using bcrypt they used SHA1 hashes with a salt pepper :(. Those are relatively easy to crack because SHA1 hashing is very very fast.
Sadly, they seemed to have used a single salt (so actually a pepper) for all passwords:
// SHA1Salt is the single salt used for all pre-BCrypt passwords
SHA1Salt = "theleakedcodecontainsthepepper"
// PasswordCutoffTime is the last time we reset passwords. Passwords older than this timestamp must be reset
PasswordCutoffTime = 1427025600 // March 22, 2015, never forget
If you logged in since March 2015, you'll have reset your password and it should no longer be stored as salted SHA1.
If a database ever leaks with the salted SHA1s still in them, it would be trivial to crack all those old passwords.