6.5 Million LinkedIn Password Hashes Leaked • Hacker News Board

Re: 6.5 Million LinkedIn Password Hashes Leaked

#161

Post by jakejake » Wed, Jun 06, 2012, 2:05 PM UTC

jere wrote: post #47

chrisaycock wrote: post #25

Earlier quoted context omitted.

Better still, use scrypt. HN's very own @cperciva wrote it. http://www.tarsnap.com/scrypt.html It requires a lot more memory to brute-force it, thereby defeating any speed gains from parallelism.

The reason people are going to use bcrypt is that there are more likely going to be bcrypt implementations in their given language: http://stackoverflow.com/questions/10149554/are-there-any-ph... I just had to make this choice a few days ago and bcrypt seemed like the best option with working PHP implementations. And I sure as hell am not going to try to roll my own.

The responses to that stack overflow question makes me want to punch somebody in the face!

The #1 google response for info about Scrypt for php now points to an article arguing about the semantics of the question with no answer. Classic!

Re: 6.5 Million LinkedIn Password Hashes Leaked

#162

Post by Pawka » Wed, Jun 06, 2012, 2:09 PM UTC

joelhaasnoot wrote: post #139

Zirro wrote: post #130

Earlier quoted context omitted.

What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?

KeePass works well too - open source, offline solution that has an "Autotype" function. I actually only run into passwords that are a pain on mobile devices. Now that my Android phone has no keyboard but tons of power, that's becoming more and more significant.

One more KeePass user here (actually KeePassX). But I'm using it only for not my own passwords, provided by others and so on.

For my personal ones I'm keeping few algorithms in my brains. I'm using resource type (website/some server/device) and name (e.g. domain/model) as variables and after few steps in my head I always have different password for each kind of service.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#163

Post by Scorpion » Wed, Jun 06, 2012, 2:09 PM UTC

madsr wrote: post #33

smiler wrote: post #9

I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.

Keep in mind that whoever leaked the hashes is probably keeping the usernames / emails for themselves. The forum in question doesn't allow posting of user-identifiable information according to the forum guidelines. The leaked hashes seems to be SHA-1. I've also confirmed that the hash of my own (semi-complex) LinkedIn password is in the list. Accidentally this is the same password as I had for HN and that I've now ch…

Oddly, mine isn't in the leak despite the fact that I just logged in with it.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#164

Post by madmaze » Wed, Jun 06, 2012, 2:09 PM UTC

I confirmed mine is in the dump as well

Re: 6.5 Million LinkedIn Password Hashes Leaked

#165

Post by fluidcruft » Wed, Jun 06, 2012, 2:10 PM UTC

Can anyone tell me where I can change my password on LinkedIn? I must be dense.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#166

Post by mikeevans » Wed, Jun 06, 2012, 2:10 PM UTC

Terretta wrote: post #105

kmfrk wrote: post #21

Earlier quoted context omitted.

Having to type in my Apple password on iOS once every few hours inevitably means I have to use something memorizable and quick to type. There are certain trade-offs with different passwords.

What's causing you to have to retype passwords every few hours? If you're doing something that makes that normal procedure, consider using the browser inside 1Password for iOS.

Installing and updating apps, I'm guessing.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#167

Post by nodata » Wed, Jun 06, 2012, 2:12 PM UTC

fluidcruft wrote: post #165

Can anyone tell me where I can change my password on LinkedIn? I must be dense.

https://www.linkedin.com/uas/change-password

It's buried under "your name" (top right) > settings > password > change (just below your e-mail, left side)

Re: 6.5 Million LinkedIn Password Hashes Leaked

#168

Post by swombat » Wed, Jun 06, 2012, 2:14 PM UTC

Torn wrote: post #137

Zirro wrote: post #130

Earlier quoted context omitted.

What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?

I've always wondered this about services like lastpass. What stops being hacked / keyloggered and them exfiltrating all your long, complex passwords?

Nothing, really. However, I trust the LastPass guys to keep their shit secure as much as I trust myself to keep my own system secure.

After all, if my own system is compromised, I just get a lot of hassle. If LastPass ever gets hacked and leaks their passwords, they lose their business overnight. That's pretty good motivation for them to keep on top of their stuff.

I used to use 1Passwd, which stored the passwords in a local file, and that could be said to be marginally more secure, except that it generally uses something like iCloud or Dropbox to sync the passwords, so there's still a single point of failure... The main reason I moved away from 1Password was that they gave me a shitty response when I asked them if they were going to support Chrome. I decided at that point that I didn't want to give them my money anymore, and so I didn't upgrade to 1Password 3.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#169

Post by Aissen » Wed, Jun 06, 2012, 2:15 PM UTC

If you want to check if your password is in there:

    read -s a
    zgrep $(echo -n "$a" | sha1sum | cut -d' ' -f1 | \
      sed -e 's/^...../00000/') combo_not.zip
    unset a

Re: 6.5 Million LinkedIn Password Hashes Leaked

#170

Post by jgrahamc » Wed, Jun 06, 2012, 2:16 PM UTC

Some observations on this file:

0. This is a file of SHA1 hashes of short strings (i.e. passwords).

1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact.

Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters set to 0 is.

  5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 is not present
  000001e4c9b93f3f0682250b6cf8331b7ee68fd8 is present

Same story for 'secret':

  e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4 is not present
  00000a1ba31ecd1ae84f75caaa474f3a663f05f4 is present

And for 'linkedin':

  7728240c80b6bfd450849405e8500d6d207783b6 is not present
  0000040c80b6bfd450849405e8500d6d207783b6 is present

2. There are 2,936,840 hashes that do not start with 00000 that can be attacked with JtR.

3. The implication of #1 is that if checking for your password and you have a simple password then you need to check for the truncated hash.

4. This may well actually be from LinkedIn. Using the partial hashes (above) I find the hashes for passwords linkedin, LinkedIn, L1nked1n, l1nked1n, L1nk3d1n, l1nk3d1n, linkedinsecret, linkedinpassword, ...

5. The file does not contain duplicates. LinkedIn claims a user base of 161m. This file contains 6.4m unique password hashes. That's 25 users per hash. Given the large amount of password reuse and poor password choices it is not improbable that this is the complete password file. Evidence against that thesis is that password of one person that I've asked is not in the list.