The summaries have private messages for those projects, with project details, email/phone as signature.

Jason – Where can I email a screenshot?

http://outsourc...urcingRoom.aspx

I know a wonderful lawyer who taught the most interesting business law classes at university then gave me personal recommendations to grad school.

And another great lawyer who’s a wonderful mother, balancing her home time and work as a lawyer, and recently defended a small site owner against a big company that wanted to take their domain for trademark infringement, when there was not even a semblence of similarity!

https://twitter.com/denparker
Download it – http://rapidsha...phones.zip.html

> even the passwords were encrypted so the
> theives cant do jack s**t with the data

Actually, they can indeed do s**t with the data. And probably are doing s**t with it.

This topic is covered in most books on cryptography, but you can also read a very quick overview on wikipedia (see “Password cracking”).

Depending on their system design, it may not even require cryptanalysis to recover at least some of those passwords (e.g., if any of the hashes can be found in the variety of rainbow tables out there).

It is best to look at the vendor’s claims of security with a wary eye. In this case, I believe that Elance is understating the risk. Consider your password on Elance to have been compromised and change it on any sites that you may have re-used that password on.

The story evolves. The site now says “passwords were protected with encryption.”

Maybe Elance is naive about encryption and password hashes. Passwords that have been “encrypted” through a one-way hash are not necessarily “secure” — There are a number of factors that affect how easy/difficult it is to recover the original passwords. In the absence of additional information about their system design regarding password hashing methods, it is difficult to determine the risk. However, it is interesting to note that Elance is requiring all users to change their passwords. That is a veiled clue to users. It would be helpful if Elance was more specific and to-the-point:

Elance users should consider their passwords to have been compromised.

If the password you used on Elance has been used on other web sites, your other web site accounts are at risk, and you should absolutely change your passwords on those sites, and strongly consider using unique passwords for each site [reference this weeks' Twitter/TC debacle].