Question for the more security-savvy among you: If the leak happened in 2012 and I've changed my password since then (it's listed in your account page [1]), do I need to change it again? Logic tells me I've got nothing to worry about, even considering potential password reuse, if they've all changed since then. [1] https://www.linkedin.com/psettings/account
LinkedIn password leak
121–130 of 218 posts
Re: LinkedIn password leak
#122Re: LinkedIn password leak
#123Re: LinkedIn password leak
#124Earlier quoted context omitted.
Why do people insist on using sms as the second factor? Let me use TOTP (e.g. Google Authenticator). I don't get reception everywhere!
I get you - but how many places do you not get sms reception but you still have enough internet connection to be trying to log in to LinkedIn? (Inside a data center, maybe?)
Re: LinkedIn password leak
#125Also, why is the 2FA option hidden under "Privacy" and not right next to the Change Password option? You'd think they would want to advertise 2FA better...
Something needs to change here.
Re: LinkedIn password leak
#126Aaaand that's why I use 'pwgen -s 22' to generate a unique password for every single site I use. I don't care if a salted password database is stolen; heck, as soon as I change my password I don't even care if a plaintext database is stolen. Why -s? Because it means each password is a complete word, and may easily be double-clicked in a password list (which is nice, because selection is copy in X). Why 22 characters?…
Creating your own passwords and typing or copy/pasting them in is a broken authentication experience.
Re: LinkedIn password leak
#127Re: LinkedIn password leak
#128Earlier quoted context omitted.
So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.
How do you randomly generate these passwords?
pwgen -y 40 1
Generates one password with 40 chars, including special chars (-y).
Re: LinkedIn password leak
#1291: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…
So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.
Your alphabet, lowercase + uppercase + digits + symbols, has 72 characters. There are 72 ways to pick the first character of your password, 72 ways to pick the second, etc. So there are 72 to the 25th power possible passwords, about 7.5 times 10 to the 46th (about 7 followed by 46 zeroes).
That's fewer possibilities than the number of atoms in the universe and fewer possibilities than the ways you can order a deck of cards, but if a computer can calculate one hash per nanosecond, it'd take about ... well, more millennia than I know the words for. Even if we're talking about a cluster of GPU machines, it's effectively forever. Unless you had some infinite improbability drive (like a quantum computer?) and you guess correctly on the first try.
So what did you use to generate the random password? Did you use your favorite programming language's pseudo-random number generator? Remember, "anyone who attempts to generate random numbers by deterministic means is, of course, living in a state of sin" (John von Neumann). A bad random number generator might only have 2^32 possibilities.
Let's put that aside. It's unlikely that the hacker knows which random number generator you used. It's much more likely that the company storing your passwords is not storing them securely. Passwords should not be stored, ever. Instead, the company should store a hashcode. The hashing algorithm should be like the butterfly effect -- a tiny change in the password produces an unpredictable difference in the hashcode. Unfortunately, many older hashing algorithms, like MD5, are predictable. A hacker can find an MD5 collision -- not your password, but one that hashes to the same hashcode -- within minutes.
There's more to it, but my advice is NEVER rely on password security by itself. If you care about your security, then use 2-factor authentication or physical security in combination with password protection.
Edit: Am I incorrect? I see there was a downvote. Please educate me.
Re: LinkedIn password leak
#130> If you’re not sure how strong your password is, test sample passwords with our password checker here. That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one. If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. Don't use the same password on multiple sites.…
One assumes LinkedIn does not store plain text passwords anywhere. That would be against best practice for the average PhpBB online forum from the late 90s. It would be criminal negligence from a company like LinkedIn. How strong your password is (and which kind of hashing function the site uses) does influence how long it takes to obtain a plausible plain text password assuming that the exfiltrated data is in the form of a list of salted hashes, which is the most reasonable assumption.
That said, changing passwords everywhere remains the safest course. Since: a) 4 years is a long time to run a password cracker + dictionary, b) there is always the possibility that the passwords were intercepted on server memory before hashing.