> test sample passwords with our password checker here.
And you just lost my trust Kaspersky, congratulations.
LinkedIn password leak
201–210 of 218 posts
Re: LinkedIn password leak
#202I've read zero reports of people breaking into houses, finding a piece of paper down the back of the cabinet with lots of passwords on and no site names, then using those passwords randomly to gain access to an unknown system... A 'software' or 'online' password manager seems like a terrible idea, all your eggs in one convenient basket, if Sony and VISA and the NSA are unable to secure their systems 100% of the time…
This is misunderstanding the threat model. Assuming you're using a local password manager and not a 'hosted' one, the moment your system is compromised, you're screwed anyway and so that single basket doesn't really matter anymore. If an attacker has sufficient access to read out passwords from RAM, it also has sufficient access to just keylog everything. To follow your analogy: if somebody physically breaks into you…
Not quite: if I can steal your password manager passwords I get all of them immediately, if I compromise your system and you don't use a password manager I can slowly steal passwords over time with some effort.
Most attempts will favour "all and now", above "slowly over time".
Re: LinkedIn password leak
#203Earlier quoted context omitted.
I like the password generator and virtual dice roller on https://www.random.org , but I guess it requires one to trust their claims that they are getting numbers from atmospheric noise and not a PRNG secretly.
More importantly, that's over the network so you have to trust the site to not log what it gives back, every CA to not have issued a false cert for them (allowing them to be trivially MITMd), and all software that runs on your computer to boot. The "PRNG" vs "Real RNG" boogeyman scare is such a load of horseshit. The whole point of modern PRNGs is that they're good enough computers can't detect patterns. I assure you…
Minor nitpick: you should replace "PRNG" with "cryptographically secure PRNG". Not all PRNG methods are aiming for the standard of "computers can't detect patterns", for example the common Mersenne Twister PRNG would not be a good choice to generate crypto keys or passwords.
You're right that using an internet service like that to generate passwords is insane, and there is no need for some fancy custom RNG hardware just to generate some keys/passwords.
Re: LinkedIn password leak
#204Earlier quoted context omitted.
The fact that your password is mailed in plain text to you when you register does not prove the password is not hashed when it's stored. In a "lost password" mail, of course, that's another thing.
A moot point. If they are sending your password across anything in plaintext, you just immediately lost a lot of the advantage you got from storing the password hashed.
If they can hack into your mail they can reset your password anyway.
(I'm not being technically correct here, but I'm being practical, and my argument here applies to 99.9999% of all cases)
Re: LinkedIn password leak
#205> If you’re not sure how strong your password is, test sample passwords with our password checker here. That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one. If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. Don't use the same password on multiple sites.…
> If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. One assumes LinkedIn does not store plain text passwords anywhere. That would be against best practice for the average PhpBB online forum from the late 90s. It would be criminal negligence from a company like LinkedIn. How strong your password is (and which kind of hashing function the site uses) d…
One assumes LinkedIn would also know better than to tell users "We'd like to import your contact list to match you up with existing members" and then go ahead and spam everyone in that contact list about joining linked in, but that was also shown to be an incorrect assumption.
The only thing one should ever assume with respect to _security_ is that the other party is going to do it wrong unless it's written out for them.
Re: LinkedIn password leak
#206Earlier quoted context omitted.
The fact that your password is mailed in plain text to you when you register does not prove the password is not hashed when it's stored. In a "lost password" mail, of course, that's another thing.
But the mail is stored!
Arguably, sending a one-time password over email in plaintext isn't a disaster. It's stored, fine, but it's no less secure than the user's email account (that you were going to reset to anyway). If internal storage on the site is still responsible, it's not a huge concern.
Of course, a truly healthy system also wouldn't allow email-only resets, but that's life.
Re: LinkedIn password leak
#207Re: LinkedIn password leak
#208Earlier quoted context omitted.
A moot point. If they are sending your password across anything in plaintext, you just immediately lost a lot of the advantage you got from storing the password hashed.
If they can hack into your mail they can reset your password anyway. (I'm not being technically correct here, but I'm being practical, and my argument here applies to 99.9999% of all cases)
It's not about hacking your email even. A significant amount of SMTP traffic still goes around unencrypted so just seeing that traffic fly by is enough to get the password.
Re: LinkedIn password leak
#209Earlier quoted context omitted.
Nitpicking. Even the Unix guys, whose line editing language you're using there, called the password hashing function "crypt"; everyone knows what it means.
"crypt" = "cryptographic hash" != "encryption". Not to mention that someone might get the wrong idea and decide that encryption (or single-round hashing) is good enough.
https://www.freebsd.org/cgi/man.cgi?crypt%283%29
NAME
crypt -- Trapdoor encryption
NAME
crypt, crypt_r - password and data encryption
NAME
crypt - string encoding function
DESCRIPTION
The crypt() function performs password encryption ...Re: LinkedIn password leak
#210Earlier quoted context omitted.
The said dump contains unsalted SHA1 encrypted passwords: https://www.leakedsource.com/blog/linkedin
Is there a complete list of the DBs in leakedsource.com somewhere? They have this result: VerticalScope Network (Vbulletin) (939 Websites). Would be nice to know all of those 939 sites.
If you'd really want to know, I would suggest contacting the website admin on HackForums.