Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn password leak

usblog.kaspersky.com

Post reply on HN
Print view View original

161–170 of 218 posts

Re: LinkedIn password leak

#161

Post by ashitlerferad »

saidajigumi wrote: post #57
wglb wrote: post #50

1: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…

As an aside, it can be so difficult to get this across to folks who aren't in the infosec headspace. I've seen even technical, computer science types absolutely not get that their ad-hoc memorable password "but no one would EVER guess that!" schemes are probably much more vulnerable than they estimate. Nevermind, even, true computing laypersons.

The only sane schemes are ones that choose passphrases solely based on entropy. So, Diceware or other random generation systems.

Re: LinkedIn password leak

#162

Post by INTPenis »

MikeJougrty wrote: post #156

So basically, if I get interviewed by a company and I get asked why I don't have a Linkedin account, am I legitimate to respond to them by saying that Linkedin sucks in many different ways including password breach?

First off I'd be skeptical about working where they take your linkedin account seriously. Secondly, no. Because everyone sucks, everyone can get hacked, why don't you have a Facebook account, a Google account, it's only a matter of time. No one is invincible.

Re: LinkedIn password leak

#163

Post by inopinatus »

13of40 wrote: post #151
jasonkostempski wrote: post #135

Earlier quoted context omitted.

"Some are in the middle, like my LinkedIn account, or my gmail account" Your email account is the golden key to all other accounts that send "forgot password" links to it.

Which is why I protect it. But not as hard as my bank account and not as soft as my fark account. Hence, "middle".

I would recommend lofting your email authentication into the same protection category as your bank account:

a) There is a nonzero probability that your bank can be socially engineered using information obtained from compromising your email account and anything that trusts it. b) An email account compromise implicitly means every service that resets/recovers through it has to be rekeyed. The subsequent cleaning of the stables can be messy, lengthy, and itself somewhat risky.

In particular, if you haven't already, enable MFA. If your email provider does not support MFA, change your provider.

Re: LinkedIn password leak

#164

Post by kazinator »

ashitlerferad wrote: post #159
Jhsto wrote: post #150

Earlier quoted context omitted.

The said dump contains unsalted SHA1 encrypted passwords: https://www.leakedsource.com/blog/linkedin

s/encrypted/hashed/

Nitpicking. Even the Unix guys, whose line editing language you're using there, called the password hashing function "crypt"; everyone knows what it means.

Re: LinkedIn password leak

#165

Post by yoha »

ben_jones wrote: post #148
saidajigumi wrote: post #57

Earlier quoted context omitted.

As an aside, it can be so difficult to get this across to folks who aren't in the infosec headspace. I've seen even technical, computer science types absolutely not get that their ad-hoc memorable password "but no one would EVER guess that!" schemes are probably much more vulnerable than they estimate. Nevermind, even, true computing laypersons.

We have to rotate our password advice to family and friends every couple years or so. It used to be "use a random combination of memorable words with a number thrown in" a la "reddogbarkhard7". Now I feel like right after guessing the 10k most common passwords a hacker would immediately brute word combinations with a single integer ending.

The worst bias is letting the users choose their passwords. They should use a generator such as [1]. The reason is that the "entropy" is not a characteristic of a password but of the way it is generated. Computers are much better at entropy than humans.

[1] http://passwordcreator.org/

Re: LinkedIn password leak

#166

Post by bigiain »

aianus wrote: post #153
bigiain wrote: post #118

Earlier quoted context omitted.

I get you - but how many places do you not get sms reception but you still have enough internet connection to be trying to log in to LinkedIn? (Inside a data center, maybe?)

> I get you - but how many places do you not get sms reception but you still have enough internet connection to be trying to log in to LinkedIn? Any time you travel internationally? My phone only has one SIM slot and it's not going to be the $10/MB roaming one from back home. SMS 2FA is an awful trend.

I agree about SMS being a bad chice for 2FA, and so do the Telcos here:

http://www.itnews.com.au/news/telcos-declare-sms-unsafe-for-...

"The lobby group for Australian telcos has declared that SMS technology should no longer be considered a safe means of verifying the identity of an individual during a banking transaction."

and

"SMS is not designed to be a secure communications channel and should not be used by banks for electronic funds transfer authentication,"

Re: LinkedIn password leak

#167

Post by [deleted] »

lazaroclapp wrote: post #130
kazinator wrote: post #114

> If you’re not sure how strong your password is, test sample passwords with our password checker here. That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one. If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. Don't use the same password on multiple sites.…

> If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. One assumes LinkedIn does not store plain text passwords anywhere. That would be against best practice for the average PhpBB online forum from the late 90s. It would be criminal negligence from a company like LinkedIn. How strong your password is (and which kind of hashing function the site uses) d…

[deleted]

Re: LinkedIn password leak

#168

Post by cyphar »

kazinator wrote: post #164
ashitlerferad wrote: post #159

Earlier quoted context omitted.

s/encrypted/hashed/

Nitpicking. Even the Unix guys, whose line editing language you're using there, called the password hashing function "crypt"; everyone knows what it means.

"crypt" = "cryptographic hash" != "encryption".

Not to mention that someone might get the wrong idea and decide that encryption (or single-round hashing) is good enough.

Re: LinkedIn password leak

#169

Post by Benjamin_Dobell »

wrong_variable wrote: post #15
hayleox wrote: post #6

Woo, I created my LinkedIn profile in 2015, so I should be safe since the leak is supposedly from 2012. If anyone else isn't sure when they made their LinkedIn, you can see your join date here (ctrl+f "Member since"): https://www.linkedin.com/psettings/

I created my profile at 2012 - thanks for that information ! Is it possible for me to check the data link to look my name up.

Yes, leakedsource.com, select "email" from the drop-down and use the email you had associated with LinkedIn in 2012.

I'm in the list :( I can't remember what password I was using in 2012, but I changed my password again anyway. At least it was never the password associated with my Gmail login, cause I'm not a derp so I don't use that anywhere but Gmail.

Post reply on HN