6.5 Million LinkedIn Password Hashes Leaked • Hacker News Board

Re: 6.5 Million LinkedIn Password Hashes Leaked

#41

Post by raverbashing » Wed, Jun 06, 2012, 12:53 PM UTC

chrisaycock wrote: post #25

avar wrote: post #12

Earlier quoted context omitted.

To expand on that, to store passwords don't just use salt+sha1, or try to do your own nested sha1, just use bcrypt: http://en.wikipedia.org/wiki/Bcrypt

Better still, use scrypt. HN's very own @cperciva wrote it. http://www.tarsnap.com/scrypt.html It requires a lot more memory to brute-force it, thereby defeating any speed gains from parallelism.

THANK YOU

"use bcrypt" has become an HN meme, with all the bad implications of it

As if scrypt, pbkdf2 didn't exist. Or as if bcrypt has always existed and doesn't have any weakness

Re: 6.5 Million LinkedIn Password Hashes Leaked

#42

Post by mjschultz » Wed, Jun 06, 2012, 12:54 PM UTC

madsr wrote: post #33

smiler wrote: post #9

I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.

Keep in mind that whoever leaked the hashes is probably keeping the usernames / emails for themselves. The forum in question doesn't allow posting of user-identifiable information according to the forum guidelines. The leaked hashes seems to be SHA-1. I've also confirmed that the hash of my own (semi-complex) LinkedIn password is in the list. Accidentally this is the same password as I had for HN and that I've now ch…

Doesn't this imply that LinkedIn doesn't salt the password prior to storing it. So then a good chunk of those passwords will be in a rainbow table.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#43

Post by jere » Wed, Jun 06, 2012, 12:54 PM UTC

pcopley wrote: post #27

esbwhat wrote: post #16

Earlier quoted context omitted.

just use a couple of shitty passwords for sites you don't care about, and remember the other ones. E.g. my hacker news account would probably be relatively unproblematic to compromise. If that were to happen, I'd just make a new one though.

But what about your kar- nevermind.

Ha. I'm in the same boat. This is my second account after the first one got ghost banned (for a single comment and the followups attempting to explain).

Re: 6.5 Million LinkedIn Password Hashes Leaked

#44

Post by ecaron » Wed, Jun 06, 2012, 12:55 PM UTC

sparknlaunch wrote: post #28

When Twitter recently had accounts and passwords leaked, many were attached to spam accounts or duplicate records. Most had obvious passwords (like 1234). Are these legitimate active accounts? Can you do anything with the hashed passwords alone?

In fairness to Twitter, it was never actually known if the accounts/passwords came from Twitter.com (proper) or (more likely) leaked from some 3rd-party Twitter-integrating app that had pre-OAuth integration.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#45

Post by Glowbox » Wed, Jun 06, 2012, 12:55 PM UTC

tocomment wrote: post #30

This makes me wonder. I've been relying on Django's built in user authentication lately. Does anyone know if that's pretty safe? Is it doing the right thing for hashing passwords?

Disclaimer: I am not a cryptographic expert.

https://docs.djangoproject.com/en/dev/topics/auth/

Django by default uses the PBKDF2 algorithm, which is better than nothing/md5/no salt sha1.

I'd use bcrypt or scrypt by default, better be safe than sorry.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#46

Post by kevindication » Wed, Jun 06, 2012, 12:56 PM UTC

smiler wrote: post #9

I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.

LinkedIn could easily match each hash to a user. Then they should lock each of those accounts and force them to change their password.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#47

Post by jere » Wed, Jun 06, 2012, 12:56 PM UTC

chrisaycock wrote: post #25

avar wrote: post #12

Earlier quoted context omitted.

To expand on that, to store passwords don't just use salt+sha1, or try to do your own nested sha1, just use bcrypt: http://en.wikipedia.org/wiki/Bcrypt

Better still, use scrypt. HN's very own @cperciva wrote it. http://www.tarsnap.com/scrypt.html It requires a lot more memory to brute-force it, thereby defeating any speed gains from parallelism.

The reason people are going to use bcrypt is that there are more likely going to be bcrypt implementations in their given language: http://stackoverflow.com/questions/10149554/are-there-any-ph...

I just had to make this choice a few days ago and bcrypt seemed like the best option with working PHP implementations. And I sure as hell am not going to try to roll my own.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#48

Post by madsr » Wed, Jun 06, 2012, 12:59 PM UTC

mjschultz wrote: post #42

madsr wrote: post #33

Earlier quoted context omitted.

Keep in mind that whoever leaked the hashes is probably keeping the usernames / emails for themselves. The forum in question doesn't allow posting of user-identifiable information according to the forum guidelines. The leaked hashes seems to be SHA-1. I've also confirmed that the hash of my own (semi-complex) LinkedIn password is in the list. Accidentally this is the same password as I had for HN and that I've now ch…

Doesn't this imply that LinkedIn doesn't salt the password prior to storing it. So then a good chunk of those passwords will be in a rainbow table.

Yes. The hash I calculated was without a salt (the same way you generate a hash on sites like http://darrenfauth.com/generators/sha1)

Re: 6.5 Million LinkedIn Password Hashes Leaked

#49

Post by ams6110 » Wed, Jun 06, 2012, 1:00 PM UTC

judofyr wrote: post #6

> - With a computer of 8,000 NOK (~ 1400 USD), you can do a few hundred million attempts per second. Are you kidding me? LinkedIn stored their passwords using (salted) SHA1 using no iterations? Jesus.

If you use the ASP.NET Membership that's what you get, unless you do something custom.

Edit: they are salted though.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#50

Post by carbocation » Wed, Jun 06, 2012, 1:00 PM UTC

raverbashing wrote: post #41

chrisaycock wrote: post #25

Earlier quoted context omitted.

Better still, use scrypt. HN's very own @cperciva wrote it. http://www.tarsnap.com/scrypt.html It requires a lot more memory to brute-force it, thereby defeating any speed gains from parallelism.

THANK YOU "use bcrypt" has become an HN meme, with all the bad implications of it As if scrypt, pbkdf2 didn't exist. Or as if bcrypt has always existed and doesn't have any weakness

If a database of bcrypted passwords from LNKD had been leaked, we'd be having a totally different conversation right now. (Same, of course, with scrypt etc.)