6.5 Million LinkedIn Password Hashes Leaked

I wonder how many LinkedIn users use the same passwords for all their accounts. The article talks about identity theft and "confidential contacts" but I think the real danger is that people tend to use the same password everywhere. It's their other accounts that might have real value.

EDIT - As I think about it, e-mail accounts would be especially valuable as most of your other sites could be compromised using the "recover my password via e-mail" feature if the hacker could read the resulting mail.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#5

Post by chli » Wed, Jun 06, 2012, 12:30 PM UTC

The forum they are talking about apparently (found using google)

http://forum.insidepro.com/viewtopic.php?p=96122&sid=133...

Re: 6.5 Million LinkedIn Password Hashes Leaked

#6

Post by judofyr » Wed, Jun 06, 2012, 12:31 PM UTC

> - With a computer of 8,000 NOK (~ 1400 USD), you can do a few hundred million attempts per second.

Are you kidding me? LinkedIn stored their passwords using (salted) SHA1 using no iterations? Jesus.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#7

Post by [deleted] » Wed, Jun 06, 2012, 12:31 PM UTC

[deleted]

Re: 6.5 Million LinkedIn Password Hashes Leaked

#8

Post by smoyer » Wed, Jun 06, 2012, 12:32 PM UTC

chli wrote: post #5

The forum they are talking about apparently (found using google) http://forum.insidepro.com/viewtopic.php?p=96122&sid=133...

The Hacker News effect seems to have taken the forums off-line. If you need a quick DDOS and don't have a botnet handy, just post the link here!

Re: 6.5 Million LinkedIn Password Hashes Leaked

#9

Post by smiler » Wed, Jun 06, 2012, 12:35 PM UTC

I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses.

I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#10

Post by jere » Wed, Jun 06, 2012, 12:35 PM UTC

smoyer wrote: post #4

I wonder how many LinkedIn users use the same passwords for all their accounts. The article talks about identity theft and "confidential contacts" but I think the real danger is that people tend to use the same password everywhere. It's their other accounts that might have real value. EDIT - As I think about it, e-mail accounts would be especially valuable as most of your other sites could be compromised using the "r…

Me. Admittedly, it's stupid as hell, but has generally been too much of a pain to do anything else (for things outside of banking, email). I've started to get serious about KeePass lately, but I bet a significant percentage of users take the lazy approach.