Sure thing: Security announcement: Devise v2.2.3, v2.1.3, v2.0.5 and v1.5.4 rele... | Hacker News

Hacker News new | past | comments | ask | show | jobs | submit

login

lawrencepit on Jan 30, 2013 | parent | context | favorite | on: To Keep Passwords Safe from Hackers, Just Break Th...

Sure thing:

Security announcement: Devise v2.2.3, v2.1.3, v2.0.5 and v1.5.4 released

http://blog.plataformatec.com.br/2013/01/security-announceme...

_3u10 on Jan 30, 2013 [–]

Upgrade immediately unless you are using PostgreSQL or SQLite3.

So using a real database mitigated the entire issue. Secondly, this security issue doesn't allow you to retrieve every user's password in 8 hours.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact