<p>Armed with password hashes and salts, attackers could already be kraken those creds</p>