Live data from Hacker News

LinkedIn password leak

usblog.kaspersky.com

121–130 of 218 posts

Re: LinkedIn password leak

#121
post #117

Question for the more security-savvy among you: If the leak happened in 2012 and I've changed my password since then (it's listed in your account page [1]), do I need to change it again? Logic tells me I've got nothing to worry about, even considering potential password reuse, if they've all changed since then. [1] https://www.linkedin.com/psettings/account

I changed it when they first announced the leak in 2012. It didn't ask me to change it when I logged today and they didn't send me the email today. I guess they know my new password is secure since I changed it since the leak.

Re: LinkedIn password leak

#123
Whats interesting to me is that their spams to change your password showed up on a whole bunch of group email addresses I am a member of. So at some point linkedin went and harvested email addresses that got to my inbox and made a bunch of bad assumptions to include those as secondary addresses for me. I can only assume it was their mobile app, which is now forever uninstalled on all my devices. I simply cannot have them doing that.

Re: LinkedIn password leak

#124

Earlier quoted context omitted.

Why do people insist on using sms as the second factor? Let me use TOTP (e.g. Google Authenticator). I don't get reception everywhere!

I get you - but how many places do you not get sms reception but you still have enough internet connection to be trying to log in to LinkedIn? (Inside a data center, maybe?)

Inside a building?

Re: LinkedIn password leak

#125

Also, why is the 2FA option hidden under "Privacy" and not right next to the Change Password option? You'd think they would want to advertise 2FA better...

2FA doesn't mean much if the user can 2FA from one device (i.e. Login to a site from a phone and request the 2FA SMS to the same phone).

Something needs to change here.

Re: LinkedIn password leak

#126
post #72

Aaaand that's why I use 'pwgen -s 22' to generate a unique password for every single site I use. I don't care if a salted password database is stolen; heck, as soon as I change my password I don't even care if a plaintext database is stolen. Why -s? Because it means each password is a complete word, and may easily be double-clicked in a password list (which is nice, because selection is copy in X). Why 22 characters?…

That's sound advice, but most of the other people on the Internet (and most of the people in the leak) don't consider entropy when authenticating with their bank/Facebook/gmail etc.

Creating your own passwords and typing or copy/pasting them in is a broken authentication experience.

Re: LinkedIn password leak

#128

Earlier quoted context omitted.

So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.

How do you randomly generate these passwords?

you can install a tool "pwgen" on linux machines that will generate you passwords, configurable with size and types of characters included.

pwgen -y 40 1

Generates one password with 40 chars, including special chars (-y).

Re: LinkedIn password leak

#129
post #50

1: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…

So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.

Depends on how that password is stored. Mostly.

Your alphabet, lowercase + uppercase + digits + symbols, has 72 characters. There are 72 ways to pick the first character of your password, 72 ways to pick the second, etc. So there are 72 to the 25th power possible passwords, about 7.5 times 10 to the 46th (about 7 followed by 46 zeroes).

That's fewer possibilities than the number of atoms in the universe and fewer possibilities than the ways you can order a deck of cards, but if a computer can calculate one hash per nanosecond, it'd take about ... well, more millennia than I know the words for. Even if we're talking about a cluster of GPU machines, it's effectively forever. Unless you had some infinite improbability drive (like a quantum computer?) and you guess correctly on the first try.

So what did you use to generate the random password? Did you use your favorite programming language's pseudo-random number generator? Remember, "anyone who attempts to generate random numbers by deterministic means is, of course, living in a state of sin" (John von Neumann). A bad random number generator might only have 2^32 possibilities.

Let's put that aside. It's unlikely that the hacker knows which random number generator you used. It's much more likely that the company storing your passwords is not storing them securely. Passwords should not be stored, ever. Instead, the company should store a hashcode. The hashing algorithm should be like the butterfly effect -- a tiny change in the password produces an unpredictable difference in the hashcode. Unfortunately, many older hashing algorithms, like MD5, are predictable. A hacker can find an MD5 collision -- not your password, but one that hashes to the same hashcode -- within minutes.

There's more to it, but my advice is NEVER rely on password security by itself. If you care about your security, then use 2-factor authentication or physical security in combination with password protection.

Edit: Am I incorrect? I see there was a downvote. Please educate me.

Re: LinkedIn password leak

#130

> If you’re not sure how strong your password is, test sample passwords with our password checker here. That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one. If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. Don't use the same password on multiple sites.…

> If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously.

One assumes LinkedIn does not store plain text passwords anywhere. That would be against best practice for the average PhpBB online forum from the late 90s. It would be criminal negligence from a company like LinkedIn. How strong your password is (and which kind of hashing function the site uses) does influence how long it takes to obtain a plausible plain text password assuming that the exfiltrated data is in the form of a list of salted hashes, which is the most reasonable assumption.

That said, changing passwords everywhere remains the safest course. Since: a) 4 years is a long time to run a password cracker + dictionary, b) there is always the possibility that the passwords were intercepted on server memory before hashing.

Post reply on HN