6.5 Million LinkedIn Password Hashes Leaked

Post by kmfrk » Wed, Jun 06, 2012, 12:43 PM UTC

jere wrote: post #10

smoyer wrote: post #4

I wonder how many LinkedIn users use the same passwords for all their accounts. The article talks about identity theft and "confidential contacts" but I think the real danger is that people tend to use the same password everywhere. It's their other accounts that might have real value. EDIT - As I think about it, e-mail accounts would be especially valuable as most of your other sites could be compromised using the "r…

Me. Admittedly, it's stupid as hell, but has generally been too much of a pain to do anything else (for things outside of banking, email). I've started to get serious about KeePass lately, but I bet a significant percentage of users take the lazy approach.

Post by snorkel » Wed, Jun 06, 2012, 12:43 PM UTC

smiler wrote: post #9

I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.

Post by chrisaycock » Wed, Jun 06, 2012, 12:46 PM UTC

avar wrote: post #12

judofyr wrote: post #6

> - With a computer of 8,000 NOK (~ 1400 USD), you can do a few hundred million attempts per second. Are you kidding me? LinkedIn stored their passwords using (salted) SHA1 using no iterations? Jesus.

To expand on that, to store passwords don't just use salt+sha1, or try to do your own nested sha1, just use bcrypt: http://en.wikipedia.org/wiki/Bcrypt

Post by pcopley » Wed, Jun 06, 2012, 12:48 PM UTC

esbwhat wrote: post #16

jere wrote: post #10

Earlier quoted context omitted.

Me. Admittedly, it's stupid as hell, but has generally been too much of a pain to do anything else (for things outside of banking, email). I've started to get serious about KeePass lately, but I bet a significant percentage of users take the lazy approach.

just use a couple of shitty passwords for sites you don't care about, and remember the other ones. E.g. my hacker news account would probably be relatively unproblematic to compromise. If that were to happen, I'd just make a new one though.

Post by scrrr » Wed, Jun 06, 2012, 12:48 PM UTC

StavrosK wrote: post #24

Can we please start using BrowserID or some other standard so we can secure that one provider and do away with all this? I'd like it if we could authenticate with Google using 2-factor authentication and be less worried about my password getting hacked.