Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6.5 Million LinkedIn Password Hashes Leaked

translate.google.com

Post reply on HN
Print view View original

141–150 of 547 posts

Re: 6.5 Million LinkedIn Password Hashes Leaked

#141

Post by veemjeem »

jere wrote: post #84
jlgreco wrote: post #67

Earlier quoted context omitted.

To be clear, MD5 (or SHA1 as these apparently are) is a problem. Passwords should be stored using a cryptographic hash function that is designed to hash passwords (read: be slow), not a generic cryptographic hash function (which are designed to be fast ). This is exactly the problem that bcrypt was created to solve (among others).

I think people are missing the point that SHA2 is light years ahead of MD5. MD5 has had known security flaws for years . >Do not use the MD5 algorithm Software developers, Certification Authorities, website owners, and users should avoid using the MD5 algorithm in any capacity. http://www.kb.cert.org/vuls/id/836068 This is from over 3 years ago.

Still, it doesn't matter. As long as one can generate a rainbow table for the hash function, then password lookups will be a O(1) operation. The rainbow table for md5 is moderately small, sha1 is bigger, and I'm sure sha2 is even bigger than the sha1 table.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#142

Post by Ecio78 »

toyg wrote: post #108
mkjones wrote: post #83

Earlier quoted context omitted.

Interesting, I tried this with a bunch of different passwords (though using php's sha1 function, which obviously gives the same output as ruby's), and found no matches. You're using the "combo_not.txt" file from the zip file in the ggp, right?

The dump is not complete -- my password is also missing. As other people said, that file contains about 6.5 million hashes, while LinkedIn has 30 times more users. Considering how usernames weren't leaked, there's a big chance that the intruder is just sitting on them and the other passwords.

My password is missing too (if i've done right the hash generation as illustrated above). It's strange that only hashes starting with "000000a9" are present, someone said here that it's just presentation but my hashed password is 40char long as those leaked including the 000000a9

Re: 6.5 Million LinkedIn Password Hashes Leaked

#143

Post by madethemcry »

chli wrote: post #5

The forum they are talking about apparently (found using google) http://forum.insidepro.com/viewtopic.php?p=96122&sid=133...

I just looked into the file (combo_not.txt). There are only hashes. Who decided that the hashes posted in the forum are related to linkedin in any way ? Thank you.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#144

Post by lemming »

jgrahamc wrote: post #112
swombat wrote: post #98

Am I glad that I use LastPass and have a different, 12-character password for every service? Why, yes, yes, I am. I've now changed my LinkedIn password, too, just in case.

I'm even happier I don't have a LinkedIn account.

I've been tempted to delete mine several times recently. Looks like now is the moment.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#145

Post by ricardobeat »

Smerity wrote: post #115

"We were curious what would happen to our share price if our company did something incredibly stupid" The above comment might seem incredibly harsh, but really, there's no good excuse for a site this prominent to not have a salted, secure password hashing system. Even if they started with an unsalted password system, users can be migrated to the newer more secure system on next login. The only way I could regain resp…

We've just checked everyone's passwords around the office. One of them was in the list, and he has accessed the site the past month.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#146

Post by jakejake »

judofyr wrote: post #6

> - With a computer of 8,000 NOK (~ 1400 USD), you can do a few hundred million attempts per second. Are you kidding me? LinkedIn stored their passwords using (salted) SHA1 using no iterations? Jesus.

I'm not familiar with iterations, anybody care to clue me in? I would have thought salted sha-1 would be decent for password hashing, though not the most solid possible, but at least not laughable. Is that not the case?

Re: 6.5 Million LinkedIn Password Hashes Leaked

#147

Post by mkjones »

madsr wrote: post #102
mkjones wrote: post #76

Earlier quoted context omitted.

Interesting - I wasn't able to find the hashes of any passwords in the list. What list were you using?

The rar with ~100k cracked passwords in it. If you tried to find your own, perhaps you're one of the ~144 million accounts that wasn't published? Edit: I'm not sure I understand what you mean - there was 100k passwords in one file, already cracked, and another with all 6.5M hashes. I found my hash in the hashes file.

Ah, I have the 6.5M file. Not sure why I'm not finding stuff from my wordlist in it, but I do see things from e.g. https://twitter.com/mikko/status/210341669944573955. Sorry for the confusion!

Re: 6.5 Million LinkedIn Password Hashes Leaked

#148

Post by miniatureape »

joelhaasnoot wrote: post #139
Zirro wrote: post #130

Earlier quoted context omitted.

What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?

KeePass works well too - open source, offline solution that has an "Autotype" function. I actually only run into passwords that are a pain on mobile devices. Now that my Android phone has no keyboard but tons of power, that's becoming more and more significant.

I use keepass too. I keep my database in dropbox and use the android dropbox and keepass clients on my android. Logging into an app or website involves opening dropbox, clicking on the database[1], entering my password, choosing the site, and clicking on "copy password to clipboard." It's a few extra steps, but it's not that much of a hassle.

[1] I find this easier than opening keepass and selecting the database from dropbox for some reason that might be as simple as dropbox having an easier to spot icon.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#149

Post by ricardobeat »

Anderkent wrote: post #113
NatW wrote: post #59

Earlier quoted context omitted.

To get a sense of it, I downloaded it from a link here. Below is the structure of the first few lines. Caveat: it's garbage/useless data below -- I intentionally changed around the actual numbers to give a sense of the structure, only: 000000a94d47b9cb82ca8a3b492a51263b40a66e 000000a98a624314892af97c6f1a0635472eae38 000000a9ba60e7f13fcac444a5a791af7807a3a3 000000a97ea34e74a97a6d1ce08ebc68d3e9aab2 000000a9b4b2a3497aaa…

The pattern 000000a9 is just in presentation - I counted the occurrences of different bytes in that position (also misled by the apparent pattern, where many lines in a row would have the same 4th byte), and each possible value is present more or less equally often. It seems like it's just sha1. EDIT: however, 3.5 million hashes start with 5 zeroes, which is way too many for just coincidence. Possibly they used multi…

It appears that the publisher just zeroed out the first 4 digits in nearly all the hashes. The rest of the string still matches known hashes.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#150

Post by iamstef »

jere wrote: post #89
tazzy531 wrote: post #80

Good Guy Startup Founder would cross reference this password list with their own password system and force those that match to reauthenticate and change their passwords. This wouldn't be difficult to do and your users would appreciate it.

How would one cross-reference this list unless you're storing the plain text passwords?

A cross-reference is only feasible in very bad situations: - no-salt or same-salt and same hashing - trivial/common passwords (password1 etc) - password(hashed/unhashed) and email are paired.

A cross-reference could be accomplished for all known cracked linkedin passwords, but this would be no different then you running a dictionary attack of known passwords against your own users... This seems very bad. Enforcing strong but sane password strength rules should mitigate this need.

Cross reference only has value if both the hash and email pairs are leaked.

The bitcoin leak fell into one of these very bad situations: - [, ] where leaked together - poor hashing (just sha1, no salt if memory serves) - unfortunate number of people reuse passwords

Post reply on HN