Gawker was made aware two years ago of flaws in its password encryption system, and promised users it would "improve" it - but did not, which made it easier for its system to be hacked earlier this year.
The flaw meant that only the first eight characters of any password were used and encrypted; any more were ignored. That put a limit on the security that the encryption could offer.
In December, the Gawker Media database of 1.3m usernames and passwords was released online by the hacking group Gnosis, who had attacked the site in revenge for its taunting of the 4Chan message board.
The hackers were able to decode at least 188,000 of the passwords, including that of the sites' chief executive and founder Nick Denton, because of the weakness.
Some of the passwords were subsequently used for a spam attack on Twitter, and users were advised to change their passwords on other sites as protection.
Bryan Campbell, a Gawker user, alerted the company to the weakness on its GetSatisfaction feedback site in November 2008.
"I have discovered a serious flaw in your logon process," Campbell wrote. "When logging in, I have a alpha numeric password, EVEN when I drop the numerical part of it, it still authenticates me, with just the alpha part. Big worry."
Another user pointed out the problem too.
Gawker's technical team responded: "Thanks for letting us know about this. We realized we have an 8-character limit on passwords. We will be improving this in the future."
But the "improvement" did not transpire: the recent hack into Gawker's system demonstrated that it only used 8-character passwords, and that anything more than that was simply dropped - precisely as Campbell had warned. Campbell says was unaffected by the hack because he had stopped using the site after discovering the flaw.
The Guardian has been told by sources close to Gnosis that the hackers first broke into Gawker's content management system (CMS) six months ago, and that they soon had free rein of the system and used the passwords they gleaned to break into other external systems used by Denton and the Gawker staff.
