Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6.5 Million LinkedIn Password Hashes Leaked

translate.google.com

Post reply on HN
Print view View original

71–80 of 547 posts

Re: 6.5 Million LinkedIn Password Hashes Leaked

#71

Post by 16s »

mjschultz wrote: post #42
madsr wrote: post #33

Earlier quoted context omitted.

Keep in mind that whoever leaked the hashes is probably keeping the usernames / emails for themselves. The forum in question doesn't allow posting of user-identifiable information according to the forum guidelines. The leaked hashes seems to be SHA-1. I've also confirmed that the hash of my own (semi-complex) LinkedIn password is in the list. Accidentally this is the same password as I had for HN and that I've now ch…

Doesn't this imply that LinkedIn doesn't salt the password prior to storing it. So then a good chunk of those passwords will be in a rainbow table.

With these sorts of simple hashes, you don't need rainbow tables when you have a few GPUs and OCLHashcat.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#72

Post by Zirro »

engtech wrote: post #66
Zirro wrote: post #32

Earlier quoted context omitted.

I've developed a system (kept only in my head) where every password I use is based off on the name of the service. This means that with just one of my passwords, you're most likely not getting anywhere. With two, you have a bigger chance of figuring out the differences and thus the system, but it works fine for me at the moment.

Other than the simple top 100 password list, a password based on the name of the service is the most likely password that everyone has. Usually something like "domainname"+"common password for all sites"

Don't underestimate me. It contains many numbers extracted from the letters according to various rules (order in alphabet, backwards, etc), along with special characters.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#73

Post by lemonad »

tocomment wrote: post #30

This makes me wonder. I've been relying on Django's built in user authentication lately. Does anyone know if that's pretty safe? Is it doing the right thing for hashing passwords?

Yes, and to make Django even more safe, a number of improvements have been made over the last year (e.g. https://code.djangoproject.com/ticket/15367).

Re: 6.5 Million LinkedIn Password Hashes Leaked

#74

Post by mdemare »

jere wrote: post #10
smoyer wrote: post #4

I wonder how many LinkedIn users use the same passwords for all their accounts. The article talks about identity theft and "confidential contacts" but I think the real danger is that people tend to use the same password everywhere. It's their other accounts that might have real value. EDIT - As I think about it, e-mail accounts would be especially valuable as most of your other sites could be compromised using the "r…

Me. Admittedly, it's stupid as hell, but has generally been too much of a pain to do anything else (for things outside of banking, email). I've started to get serious about KeePass lately, but I bet a significant percentage of users take the lazy approach.

My linkedin password is an easy one. Then I checked 1password to see how many other sites I use that password on.

74 sites... including gmail, openid, facebook, skype, amazon, dropbox, reddit and this site.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#76

Post by mkjones »

madsr wrote: post #33
smiler wrote: post #9

I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.

Keep in mind that whoever leaked the hashes is probably keeping the usernames / emails for themselves. The forum in question doesn't allow posting of user-identifiable information according to the forum guidelines. The leaked hashes seems to be SHA-1. I've also confirmed that the hash of my own (semi-complex) LinkedIn password is in the list. Accidentally this is the same password as I had for HN and that I've now ch…

Interesting - I wasn't able to find the hashes of any passwords in the list. What list were you using?

Re: 6.5 Million LinkedIn Password Hashes Leaked

#77

Post by seiji »

madsr wrote: post #58

What riddles me though, is how come 6.5 million? LinkedIn has what, 150M users? Did they not post the entire load (and are in fact sitting on _all_ the hashes?) Is the dump an old backup or breach from when they had fewer accounts? Is it just one DB partition / file that's been lost, an archive?

Ways I've seen this play out before:

• Someone got in to one user database, but not all of them.

• Someone got into the complete user database, but were found out during the intrusion and cut off.

• Someone found a sharded DB dump or backup.

• Someone found/stole/virus'd a dev laptop with DB dumps.

• Someone sat on the network for a while and grabbed app server -> DB traffic.

Replace "Someone" with "russians," "brazilians," or "something behind tor" for more accurate portrayals.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#78

Post by unimpressive »

StavrosK wrote: post #24

Can we please start using BrowserID or some other standard so we can secure that one provider and do away with all this? I'd like it if we could authenticate with Google using 2-factor authentication and be less worried about my password getting hacked.

Why can't we just use good old PGP?

There is no reason why we should centralize password management and put the world's authentication into one giant pinata for black hats to take a swing at.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#79

Post by mibbitier »

kevindication wrote: post #46
smiler wrote: post #9

I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.

LinkedIn could easily match each hash to a user. Then they should lock each of those accounts and force them to change their password.

From the looks of it, the data dump may be all accounts - since there seems to be no salt, and many people use same passwords...
Post reply on HN