31–40 of 547 posts
Can I be sure my account was totally removed when I removed my LinkedIn account? Because the "please change your password as soon as possible" won't help me much.
I wonder how many LinkedIn users use the same passwords for all their accounts. The article talks about identity theft and "confidential contacts" but I think the real danger is that people tend to use the same password everywhere. It's their other accounts that might have real value. EDIT - As I think about it, e-mail accounts would be especially valuable as most of your other sites could be compromised using the "r…
Me. Admittedly, it's stupid as hell, but has generally been too much of a pain to do anything else (for things outside of banking, email). I've started to get serious about KeePass lately, but I bet a significant percentage of users take the lazy approach.
I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.
The leaked hashes seems to be SHA-1. I've also confirmed that the hash of my own (semi-complex) LinkedIn password is in the list. Accidentally this is the same password as I had for HN and that I've now changed (phew! THAT'd been bad! :-)
I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.
Earlier quoted context omitted.
Agreed. That seems rather useless. How would that happen anyway? The usernames stored in a different database/table from the hashes?
They might need help cracking the hashes, keeping the usernames behind for their own exploits.
Database is available here https://disk.yandex.net/disk/public/?hash=pCAcIfV7wxXCL/YPhO... (Source: twitter, haven't looked at it myself)
Those just look like hashes - are there usernames / salts somewhere? They do indeed seem to be salted.
> irb
> require 'digest/sha1'
> Digest::SHA1.hexdigest 'my_password'
=> hash_string
Then I searched the file with the hash string and found my password. I really hope they don't also have the usernames somewhere.
Can we please start using BrowserID or some other standard so we can secure that one provider and do away with all this? I'd like it if we could authenticate with Google using 2-factor authentication and be less worried about my password getting hacked.
Finally, when that central provider gets hacked, all your dependent services are now also compromised.
And as we know from the CloudFlare story over the weekend, not even Google with their 2 factor authentication is devoid of issues.
No. Centralizing your login to one third-party as as bad as the current practice of reusing your password for every service you have an account with. The only way that is reasonably safe is to use different random credentials for every service and store these credentials somewhere under your (and only your) control (i.e. a password manager or a piece of paper)
I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.
You can use it for checking whether your password was leaked. You don't need usernames for that.
Does anyone know what encryption scheme LinkedIn uses?