61–70 of 218 posts
I got an email from them this morning about this, it just smells like all their other junkmail begging me to +1 their active users. Why don't they invalidate the passwords all at once instead of letting -- someone -- use the potentially compromised passwords again...
1: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…
1: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…
So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.
https://github.com/ulif/diceware/
$ pip install diceware
$ diceware -n 8 -d ' ' --no-caps
proton hunts blake 31 pope pivot taped plainWoo, I created my LinkedIn profile in 2015, so I should be safe since the leak is supposedly from 2012. If anyone else isn't sure when they made their LinkedIn, you can see your join date here (ctrl+f "Member since"): https://www.linkedin.com/psettings/
2009... Awesome. Linkedin should probably be the one warning me about this, but I never heard of this before. Edit: filtered as Spam, nevertheless they should have locked my account.
Earlier quoted context omitted.
So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.
How do you randomly generate these passwords?
1: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…
Earlier quoted context omitted.
Why would you think that? Linkedin isn't really known for substance or integrity are they? Also didn't it come to light that they didn't use salts either?
If you look at Cory Scott's linked-in profile, you can see that there was NO security team before he was hired. None. The breach happened before he arrived, and he is now having to deal with a four year old breach. He has built a substantial team from nothing and from what I can tell is doing all the right things.
As someone who isn't versed in security issues, can anyone explain how security breaches like this one (and Adobe etc.) occur? I'm assuming (and I may be completely wrong) that some kind of software monitors if the database of customer details is being downloaded. If a download is detected, an alert is issued. Does software like this exist? Or there other measure that guard against these data breaches?
There is some software that can detect an anomaly in the regular pattern of network usage, and possibly even cut the connection, but again, I'm not sure how effective they would be here.
In any case, considering they were using unsalted SHA-1 hashes of the passwords, which was well known to be a poor practice, you should probably assume they had very little protections.