Database is available here https://disk.yandex.net/disk/public/?hash=pCAcIfV7wxXCL/YPhO... (Source: twitter, haven't looked at it myself)
I miss the days where wget/curl worked to download files from the web.
6.5 Million LinkedIn Password Hashes Leaked
11–20 of 547 posts
Re: 6.5 Million LinkedIn Password Hashes Leaked
#12> - With a computer of 8,000 NOK (~ 1400 USD), you can do a few hundred million attempts per second. Are you kidding me? LinkedIn stored their passwords using (salted) SHA1 using no iterations? Jesus.
To expand on that, to store passwords don't just use salt+sha1, or try to do your own nested sha1, just use bcrypt: http://en.wikipedia.org/wiki/Bcrypt
Re: 6.5 Million LinkedIn Password Hashes Leaked
#13I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.
Agreed. That seems rather useless. How would that happen anyway? The usernames stored in a different database/table from the hashes?
Re: 6.5 Million LinkedIn Password Hashes Leaked
#14The forum they are talking about apparently (found using google) http://forum.insidepro.com/viewtopic.php?p=96122&sid=133...
The Hacker News effect seems to have taken the forums off-line. If you need a quick DDOS and don't have a botnet handy, just post the link here!
Might also be the fact it's all over twitter.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#15The forum they are talking about apparently (found using google) http://forum.insidepro.com/viewtopic.php?p=96122&sid=133...
The Hacker News effect seems to have taken the forums off-line. If you need a quick DDOS and don't have a botnet handy, just post the link here!
https://www.dropbox.com/s/dsiuavbbzt8cy7g/forum.insidepro.co...
A saved copy of my local cache...
Re: 6.5 Million LinkedIn Password Hashes Leaked
#16I wonder how many LinkedIn users use the same passwords for all their accounts. The article talks about identity theft and "confidential contacts" but I think the real danger is that people tend to use the same password everywhere. It's their other accounts that might have real value. EDIT - As I think about it, e-mail accounts would be especially valuable as most of your other sites could be compromised using the "r…
Me. Admittedly, it's stupid as hell, but has generally been too much of a pain to do anything else (for things outside of banking, email). I've started to get serious about KeePass lately, but I bet a significant percentage of users take the lazy approach.
just use a couple of shitty passwords for sites you don't care about, and remember the other ones.
E.g. my hacker news account would probably be relatively unproblematic to compromise. If that were to happen, I'd just make a new one though.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#17I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.
Agreed. That seems rather useless. How would that happen anyway? The usernames stored in a different database/table from the hashes?
They might need help cracking the hashes, keeping the usernames behind for their own exploits.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#18I wonder how many LinkedIn users use the same passwords for all their accounts. The article talks about identity theft and "confidential contacts" but I think the real danger is that people tend to use the same password everywhere. It's their other accounts that might have real value. EDIT - As I think about it, e-mail accounts would be especially valuable as most of your other sites could be compromised using the "r…
Me. Admittedly, it's stupid as hell, but has generally been too much of a pain to do anything else (for things outside of banking, email). I've started to get serious about KeePass lately, but I bet a significant percentage of users take the lazy approach.
Full disclosure: I reuse passwords on "low-value" accounts too ... I am NOT innocent either.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#19I wonder how many LinkedIn users use the same passwords for all their accounts. The article talks about identity theft and "confidential contacts" but I think the real danger is that people tend to use the same password everywhere. It's their other accounts that might have real value. EDIT - As I think about it, e-mail accounts would be especially valuable as most of your other sites could be compromised using the "r…
I generally use the same password for what I feel are non-critical sites like LinkedIn, twitter and Facebook. Another password for testing new services/apps etc. As a rule any site that may contain my credit card data or sensitive information I use a separate password. I feel this is the best compromise to having complex passwords for each account.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#20Does anyone know what encryption scheme LinkedIn uses?