Salted Passwords are good. but, if old algorithms like MD5 then it is no use

In case of Mathway, the storage mechanism for the passwords is PHPASS, which gets salted MD5. Allan says " if I wanted to crack these passwords,I could do so on a rig that computes millions of MD5 hashes a second. With more secure cryptographic hashes, such as bcrypt or scrypt, it is much slower to compute the hash."

https://www.scmagazine.com/home/security-news/mathway-breach-latest-caper-for-shiny-hunters/

Someone forgot the importance of API and cryptographic keys - NCSU academics scanned GitHub accounts for a period of nearly six months and found 575,456 API and cryptographic keys, of which 201,642 were unique, all spread over more than 100,000 GitHub project. 81% of the secrets were not removed," researchers said. "It is likely that the developers for this 81% either do not know the secrets are being committed or are underestimating the risk of compromise."

In one case, we found what we believe to be AWS credentials for a major website relied upon by millions of college applicants in the United States, possibly leaked by a contractor

They also found AWS credentials for the website of a major government agency in a Western European country. In that case, we were able to verify the validity of the account, and even the specific developer who committed the secrets. This developer claims in their online presence to have nearly 10 years of development experience

Last, but not least, researchers also found 7,280 RSA keys inside OpenVPN config files. By looking at the other settings found inside these configuration files, researchers said that the vast majority of the users had disabled password authentication and were relying solely on the RSA keys for authentication, meaning anyone who found these keys could have gained accessed to thousands of private networks.

https://www.zdnet.com/article/over-100000-github-repos-have-leaked-api-or-cryptographic-keys/

Remember "He Went to Jared" Commercial - Here is an add-on "And he could access other orders by changing a link in his confirmation email".

A  bug was discovered and reported by a Jared customer who learned he could access other shoppers' orders by altering a link in his confirmation email and pasting the link into his browser. It was a small change, the report states, but it led him to orders containing peoples' names, billing and shipping addresses, phone numbers, email addresses, items and amount purchased, delivery date, tracking link, and the last four digits of the credit card used

“Being a Web developer, the only thing I can chalk this up to is complete incompetence, and being very lazy and indifferent to your customers’ data,” he said. “This isn’t novel stuff, it’s basic Web site security.”

https://krebsonsecurity.com/2018/12/jared-kay-jewelers-parent-fixes-data-leak/

Common sense says "Encryption" means that you will need a "KEY" to decrypt it - when the researchers tested self-encrypting SSDs from Samsung and Crucial — they found fundamental vulnerabilities in many models that make it possible for someone to bypass the encryption entirely

The flaws allow anyone with the requisite know-how and physical access to the drives to recover encrypted data without the need for any passwords or decryption keys.

One fundamental flaw  was a failure to properly bind the disk encryption key (DEK) to a password.

The full disk hardware encryption available on some widely used storage devices is so poorly implemented there may as well not be any encryption on them at all,


Another fundamental flaw the researchers discovered allows for a disk encryption key to be recovered from an SSD even after a user sets a new master password for it. In this case, the vulnerability is tied to a property of flash memory in SSDs called "wear leveling,"


https://www.darkreading.com/vulnerabilities---threats/critical-encryption-bypass-flaws-in-popular-ssds-compromise-data-security/d/d-id/1333207

Can someone write a book with a title that is something like "Cloud Security for Developers"

Researchers from mobile security firm Appthority discovered that many app developers' fail to properly secure their back-end Firebase endpoints with firewalls and authentication, leaving hundreds of gigabytes of sensitive data (over 100 million data records, including plain text passwords, user IDs, location, and in some cases, financial records such as banking and cryptocurrency transactions) of their customers publicly accessible to anyone


They  scanned over 2.7 million apps and found that more than 3,000 apps—2,446 Android and 600 iOS apps—were leaking a whole 2,300 databases with more than 100 million records, making it a giant breach of over 113 gigabytes of data

https://thehackernews.com/2018/06/mobile-security-firebase-hosting.html

In the computer world the word "Debug" generally means, it is "temporary" and meant for troubleshooting Unfortunately, Countless Android devices including DVRs, mobile telephones, Android smart TVs, and even tankers are are open to attack after being shipped with a debug port (TCP 5555) left unsecured

In the computer world the word "Debug" generally means, it is "temporary" and meant for troubleshooting Unfortunately, Countless Android devices including DVRs, mobile telephones, Android smart TVs, and even tankers are are open to attack after being shipped with a debug port (TCP 5555) left unsecureds, silently install software, and execute malicious code, without any need for a password.

Android Debug Bridge (ADB) is a feature that allows developers to communicate with an Android device remotely, executing commands, and – if necessary – taking full remote control.

A network worm called ADB.Miner has been seen scanning across the internet to see where TCP port 5555 used by ADB has been left open, in an attempt to create a cryptomining botnet.

https://hotforsecurity.bitdefender.com/blog/tens-of-thousands-of-android-devices-are-leaving-their-debug-port-exposed-20012.html