passwords

I then try passwords where the first character of the password hash is 'f' and the second is different.

Specifically: I try passwords where the first character of the hash is different.

This means they don't use a one-way hash for the passwords.

> Fingerprints are usernames, not passwords, even if some people use them as passwords.

You don't generate passwords for people, although you could, as long as you don't reveal your hash function.

One of the most important things about passwords (and passphrases!) is that they may be changed at any time.

This is more valuable than spam - you have passwords, which for most people are practically global.

The other issue is whether your passwords would be lost if they shut down, or had some catastrophic server failure.

If your attacker is not the Mossad, you can use strong passwords and avoid shady websites and you should be okay.

The company saves customers’ basic information—name, contact details, passwords, demographic data and credit card specifics —but it also digs a bit deeper.

Every time there is an unauthorized data dump, we get lists of thousands of passwords or hashes thereof.

That might be fatal if you're using diceware, I don't know if you could accommodate passwords that big.

I'm guessing that's where the author got his notion of "contact details, passwords, demographic data and credit card specifics".

The entire concept of "biometric passwords" is flawed, because as you see, they "cannot be changed for obvious reasons".

Then there's "oh man, we don't encrypt our passwords AT ALL", which really belongs in the realm of mistakes made by 15 year-olds.

Store the salt in the database with the user, and if you want to get really fancy you embed a single random value ("pepper") in the application code - this is a kind of last-ditch effort to hopefully prevent user passwords from being leaked even if the database is leaked.