On: Adobe confirms stolen passwords were encrypted, no...

[bigiain]

" … assuming that the key was not also stolen?"

Is that a sensible/defensible assumption though?

from: http://www.csoonline.com/article/742228/stolen-adobe-account...

"In an update on the data breach disclosed earlier this month, Adobe has said that source code for Photoshop was stolen."

I might be being overly paranoid, but I've shut down Adobe's Air/Acrobat/Flash updaters at the firewall until I hear plausible sounding assurances that Adobe didn't lose _everything_ in this breach, including software signing keys, update servers, DNS SOAs – the whole lot. _Maybe_ some of that stuff was better secured than the Photoshop source code… But would you bet every machine on your network that they "only" lost ~130million account credentials and the Photoshop source code, but nothing else?

[0x0 → bigiain]

Oh you mean like having the code signing service being compromised and used to signed malware?

http://www.zdnet.com/adobe-code-signing-infrastructure-hacke...

[speeder → bigiain]

Some people are claiming credit cards used to buy CS6 and whatnot are compromised too.