You are absolutely right, and I really appreciate this from Valve. There is only one thing that would have made it better: even more info. He says passwords were "hashed and salted." This could be anything from the naïve MD5(pass+salt) to the more secure bcrypt or PBKDF2. Now, I have every reason to believe that Valve is smart enough to not use methods like the first, but information is always welcome in a scenario like this. There should be no reason to hide your cryptography method provided that it is secure.
> Sony, Adobe and their ilk could learn a lot from this company.
> Sony, Adobe and their ilk could learn a lot from this company.
And unfortunately they won’t listen…