Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn password leak

usblog.kaspersky.com

Post reply on HN
Print view View original

81–90 of 218 posts

Re: LinkedIn password leak

#81

Post by adriancooney »

jlgaddis wrote: post #34
joelthelion wrote: post #12

Do we know how strong their hashing scheme was? Edit: SHA-1... You'd think a site as big as linkedin would have strong hashing...

Unsalted SHA1.

This is just unforgivable. This is such an incredibly basic and simple to implement feature and they've just ignored it. There should be some legal repercussions for companies neglecting security. When they surpass 100,000 users, a mandatory security audit should be passed (like a health and safety inspection). Data breaches like these just happen far too often.

Re: LinkedIn password leak

#82

Post by savanaly »

zeveb wrote: post #72

Aaaand that's why I use 'pwgen -s 22' to generate a unique password for every single site I use. I don't care if a salted password database is stolen; heck, as soon as I change my password I don't even care if a plaintext database is stolen. Why -s? Because it means each password is a complete word, and may easily be double-clicked in a password list (which is nice, because selection is copy in X). Why 22 characters?…

How do you track those passwords? I presume not with a password manager otherwise it would be creating your passwords for you. Do you keep them in a text file on your computer or write them down and carry them around with you or something?

Re: LinkedIn password leak

#83

Post by LeoPanthera »

zeveb wrote: post #72

Aaaand that's why I use 'pwgen -s 22' to generate a unique password for every single site I use. I don't care if a salted password database is stolen; heck, as soon as I change my password I don't even care if a plaintext database is stolen. Why -s? Because it means each password is a complete word, and may easily be double-clicked in a password list (which is nice, because selection is copy in X). Why 22 characters?…

I use "apg".

    apg -a 0 -n 1 -m 14 -x 14 -M NCL
-a lgorithm 0 is "pronounceable". 1 is "random chars".

-n umber of passwords to generate

-m inimum and ma -x imum length

-M specifies what types of characters to use. N = Numbers C = Capital letters L = Lowercase letters. You can also add S for punctuation.

14 chars with numbers letters and caps gets you ~80 bits of entropy, which is the NIST recommended value for passwords.

I store them in 1Password. (Whose password generator I don't like, but is still infinitely better than picking your own passwords in your head.)

Re: LinkedIn password leak

#84

Post by sbierwagen »

iimpact wrote: post #66
chronial wrote: post #63

Earlier quoted context omitted.

How do you randomly generate these passwords?

password managers

Tinfoil hat time: if your password manager uses a bad generation scheme or backdoored RNG like Dual EC, then its passwords might be much easier to crack than they would appear.

https://en.wikipedia.org/wiki/Dual_EC_DRBG

Re: LinkedIn password leak

#85

Post by scoot »

wglb wrote: post #50

1: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…

>> test sample passwords with our password checker

> Seriously?

Sample passwords, not your actual passwords.

If you follow that link, they reinforce that with: "Never enter your real password".

Re: LinkedIn password leak

#86

Post by Coincoin »

open-source-ux wrote: post #21

As someone who isn't versed in security issues, can anyone explain how security breaches like this one (and Adobe etc.) occur? I'm assuming (and I may be completely wrong) that some kind of software monitors if the database of customer details is being downloaded. If a download is detected, an alert is issued. Does software like this exist? Or there other measure that guard against these data breaches?

You don't necessarily need to get your hands on the actual database. You can also obtain the data through a side channel such as debug pages or errors messages being a little bit too generous with information.

Re: LinkedIn password leak

#87

Post by newman314 »

LeoPanthera wrote: post #83
zeveb wrote: post #72

Aaaand that's why I use 'pwgen -s 22' to generate a unique password for every single site I use. I don't care if a salted password database is stolen; heck, as soon as I change my password I don't even care if a plaintext database is stolen. Why -s? Because it means each password is a complete word, and may easily be double-clicked in a password list (which is nice, because selection is copy in X). Why 22 characters?…

I use "apg". apg -a 0 -n 1 -m 14 -x 14 -M NCL -a lgorithm 0 is "pronounceable". 1 is "random chars". -n umber of passwords to generate -m inimum and ma -x imum length -M specifies what types of characters to use. N = Numbers C = Capital letters L = Lowercase letters. You can also add S for punctuation. 14 chars with numbers letters and caps gets you ~80 bits of entropy, which is the NIST recommended value for passwor…

Why not?

Re: LinkedIn password leak

#88

Post by optimusclimb »

tomp wrote: post #58
benologist wrote: post #27

I got an email from them this morning about this, it just smells like all their other junkmail begging me to +1 their active users. Why don't they invalidate the passwords all at once instead of letting -- someone -- use the potentially compromised passwords again...

Incredible... The email says: "We've recently noticed a potential risk to your LinkedIn account coming from outside LinkedIn." That's almost as bad as saying "we take security very seriously" after a hack!

What does that even mean?

How can a risk come from "outside" LinkedIn related to my password? If I haven't leaked my own password, then there should be nothing to fear, and my account should be secure.

Unless of course LINKEDIN ITSELF is compromised, and leaked my password. In that case, the wording about "coming form outside LinkedIn" just smells like BS/spin to me.

Re: LinkedIn password leak

#89

Post by copperx »

electic wrote: post #33

Folks, this is becoming a common occurrence. Use a password generator and password vault to protect against this type of scenario.

A password vault ties you to a particular computer or mobile device. It's terribly inconvenient. But it's the best thing that we have today.

Re: LinkedIn password leak

#90

Post by LeoPanthera »

newman314 wrote: post #87
LeoPanthera wrote: post #83

Earlier quoted context omitted.

I use "apg". apg -a 0 -n 1 -m 14 -x 14 -M NCL -a lgorithm 0 is "pronounceable". 1 is "random chars". -n umber of passwords to generate -m inimum and ma -x imum length -M specifies what types of characters to use. N = Numbers C = Capital letters L = Lowercase letters. You can also add S for punctuation. 14 chars with numbers letters and caps gets you ~80 bits of entropy, which is the NIST recommended value for passwor…

Why not?

I don't like that you have to specify a fixed number of numbers, special chars, etc.
Post reply on HN