Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn password leak

usblog.kaspersky.com

Post reply on HN
Print view View original

101–110 of 218 posts

Re: LinkedIn password leak

#101

Post by nighthawk454 »

misiti3780 wrote: post #76

this might be a dumb question - but if the password was unique to that account AND you have 2 factor auth enabled, is there any reason you need to change the password ? so if some hacker somehow manages to backward engineer a salted-bcrypted-hash of my unique password, he still cant get in without my cell phone

Perhaps they won't get into your account without your password and phone. However, you've reduced your 2-Factor to 1-Factor since the password is now known. You're still relatively safe - at least safer than not having 2-Factor auth - but changing passwords is cheaper than the risk of relying on 1-Factor auth.

Re: LinkedIn password leak

#102

Post by d_k_f »

OhHeyItsE wrote: post #78
ryanlol wrote: post #74

Earlier quoted context omitted.

No. Salting mostly prevents rainbow tables from being very useful, but rainbow tables are questionably useful anyway with modern hardware. (Obviously depending on the type of the hash)

Yeah but isn't this method just a giant rainbow table whose source is crawlable web content? >It would have been impossible to use a brute-force attack or even a combined dictionary to crack a phrase of that length. But because the phrase was contained in this Wikipedia article, it wound up in a word list that allowed Chrysannthou to crack the phrase in a matter of minutes.

This most likely depends on the way you look at it (or rather how exactly he did it): did he take the word list, generate hashes from it and then check them against leaked hashes? Rainbow table.

If he took the word list to run login attempts against a server (or a local endpoint checking the leaked database) it's more of a dictionary attack.

Same result, different ways to get there. If you're able to run your cracker locally against a leaked db, it probably doesn't really matter.

Re: LinkedIn password leak

#103

Post by wglb »

fnordsensei wrote: post #62
wglb wrote: post #50

1: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…

So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.

That is a good choice, and it is what I recommend to whoever will listen to me, and a few that won't.

I use and recommend 1Password. To evaluate a password manager, check this page https://discussions.agilebits.com/discussion/15416/1password... for good questions to ask. For example, what data they can turn over, what their encryption practices are. Key phrase: "There is no data of yours that we keep, so there is nothing to turnover".

This can't be said by all password managers.

Re: LinkedIn password leak

#104

Post by dangerlibrary »

copperx wrote: post #89
electic wrote: post #33

Folks, this is becoming a common occurrence. Use a password generator and password vault to protect against this type of scenario.

A password vault ties you to a particular computer or mobile device. It's terribly inconvenient. But it's the best thing that we have today.

keepass + dropbox works ok.

Re: LinkedIn password leak

#105

Post by wglb »

manigandham wrote: post #45
tptacek wrote: post #43

Earlier quoted context omitted.

LinkedIn has a solid security team today. That was probably not the case when this breach apparently happened, though. Just because the dump leaked today has SHA-1 hashes, doesn't mean that's what they're doing now.

They should have never been doing that. And they regardless of what team they have, they have a terrible perception.

Even that few years ago, the percentage of companies doing exactly that was pretty large. The message about bcrypt has in fact made its mark.

Re: LinkedIn password leak

#106

Post by jimktrains2 »

jasonpeacock wrote: post #52

Also, why is the 2FA option hidden under "Privacy" and not right next to the Change Password option? You'd think they would want to advertise 2FA better...

Why do people insist on using sms as the second factor? Let me use TOTP (e.g. Google Authenticator). I don't get reception everywhere!

Re: LinkedIn password leak

#107

Post by bobwaycott »

semi-extrinsic wrote: post #65
cfontes wrote: post #28

Earlier quoted context omitted.

2009... Awesome. Linkedin should probably be the one warning me about this, but I never heard of this before. Edit: filtered as Spam, nevertheless they should have locked my account.

I believe it's been proven impossible to write a spam filter to distinguish useful LinkedIn email from spammy LinkedIn emails, since the spam filter would then be able to solve the halting problem.

Omgosh, please tell me this has actually been proven and there's a paper (or blog post at least) to read about it!

Re: LinkedIn password leak

#108

Post by ljk »

tomp wrote: post #58
benologist wrote: post #27

I got an email from them this morning about this, it just smells like all their other junkmail begging me to +1 their active users. Why don't they invalidate the passwords all at once instead of letting -- someone -- use the potentially compromised passwords again...

Incredible... The email says: "We've recently noticed a potential risk to your LinkedIn account coming from outside LinkedIn." That's almost as bad as saying "we take security very seriously" after a hack!

gotta spin!

Re: LinkedIn password leak

#109

Post by ryanlol »

tptacek wrote: post #43
bogomipz wrote: post #26

Earlier quoted context omitted.

Why would you think that? Linkedin isn't really known for substance or integrity are they? Also didn't it come to light that they didn't use salts either?

LinkedIn has a solid security team today. That was probably not the case when this breach apparently happened, though. Just because the dump leaked today has SHA-1 hashes, doesn't mean that's what they're doing now.

No, a "solid security team" doesn't wait 4 years to do password resets, nor do they let people use their personal emails for work repos.

"There are no experts, only various levels of incompetence" ;)

Re: LinkedIn password leak

#110

Post by addled »

chronial wrote: post #63
fnordsensei wrote: post #62

Earlier quoted context omitted.

So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.

How do you randomly generate these passwords?

I like the password generator and virtual dice roller on https://www.random.org, but I guess it requires one to trust their claims that they are getting numbers from atmospheric noise and not a PRNG secretly.
Post reply on HN