131–140 of 547 posts
Earlier quoted context omitted.
My linkedin password is an easy one. Then I checked 1password to see how many other sites I use that password on. 74 sites... including gmail, openid, facebook, skype, amazon, dropbox, reddit and this site.
Out of curiosity: if you use 1Password, why are you reusing a password across critical sites?
Does anyone know what encryption scheme LinkedIn uses?
I only build tiny websites compared to linkedin and even I take the time to use a proper hashing scheme with a salt. Shame on you, LinkedIn.
Earlier quoted context omitted.
MD5 isn't the issue - it's the lack of salting. Without a salt, almost any hash can be cracked with a rainbow table. With a salt, you'd need to know the salt for each hash, and then generate a new rainbow table, in order to recover the original password.
This isn't really the issue. The real issue is that MD5 (though these hashes are SHA1, which has the same problem) are too easily computed; they are practically byte-forceable. I don't need a rainbow table to compute hashes when I can slam out millions in short order using a GPU. You have a good point about needing to know the salt, but getting the salt is generally easy because it's usually stored in the same place…
Not defending the choice - bcrypt is obviously a much better way to go.
I wrote a short article about this kind of stuff - if it's really my data, then let me use my lock on it : http://ragmondocom.appspot.com/2012/03/My-Stuff-My-Lock Then I get to choose what strength lock I put on it.
"Use your own lock" is fine for us Übergeeks, but for the vast majority of the populace, they just want the provider to put a system in place so they don't have to worry about it.
Am I glad that I use LastPass and have a different, 12-character password for every service? Why, yes, yes, I am. I've now changed my LinkedIn password, too, just in case.
What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?
Edit: I wrote SHA1-Pass, so I'm biased, but I know what you mean about having trust issues with closed-source password tools. That's one of the reasons I wrote it.
"We were curious what would happen to our share price if our company did something incredibly stupid" The above comment might seem incredibly harsh, but really, there's no good excuse for a site this prominent to not have a salted, secure password hashing system. Even if they started with an unsalted password system, users can be migrated to the newer more secure system on next login. The only way I could regain resp…
Am I glad that I use LastPass and have a different, 12-character password for every service? Why, yes, yes, I am. I've now changed my LinkedIn password, too, just in case.
What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?
What stops being hacked / keyloggered and them exfiltrating all your long, complex passwords?
"We were curious what would happen to our share price if our company did something incredibly stupid" The above comment might seem incredibly harsh, but really, there's no good excuse for a site this prominent to not have a salted, secure password hashing system. Even if they started with an unsalted password system, users can be migrated to the newer more secure system on next login. The only way I could regain resp…
(Not recommending it, just wondering if my reasoning is correct.)
Am I glad that I use LastPass and have a different, 12-character password for every service? Why, yes, yes, I am. I've now changed my LinkedIn password, too, just in case.
What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?