6.5 Million LinkedIn Password Hashes Leaked • Hacker News Board

Re: 6.5 Million LinkedIn Password Hashes Leaked

#191

Post by cschneid » Wed, Jun 06, 2012, 2:35 PM UTC

bstar77 wrote: post #187

I have an ignorant question... when a SHA1 encrypted password is cracked, can the hackers actually identify what the unencrypted password is? I'm guessing no since SHA1 uses a hashing algorithm and only a brute force approach would potentially work...

"Cracking" in this sense is brute forcing. SHA1 is fast, and people use bad passwords. The combination means that you can run through lots and lots of bad passwords very quickly. I checked my linked in password I have stored in 1password, and it is 20+ chars with special characters and numbers. That won't be "cracked" in any meaningful sense, so I don't even worry about it.

You are correct that there's currently no way to go from a hash to a value that hashes to it in SHA1 (AFAIK, IANYNSA [I am not your NSA]).

Re: 6.5 Million LinkedIn Password Hashes Leaked

#192

Post by king_jester » Wed, Jun 06, 2012, 2:35 PM UTC

miniatureape wrote: post #148

joelhaasnoot wrote: post #139

Earlier quoted context omitted.

KeePass works well too - open source, offline solution that has an "Autotype" function. I actually only run into passwords that are a pain on mobile devices. Now that my Android phone has no keyboard but tons of power, that's becoming more and more significant.

I use keepass too. I keep my database in dropbox and use the android dropbox and keepass clients on my android. Logging into an app or website involves opening dropbox, clicking on the database[1], entering my password, choosing the site, and clicking on "copy password to clipboard." It's a few extra steps, but it's not that much of a hassle. [1] I find this easier than opening keepass and selecting the database from…

You can also use the favorite feature on Dropbox to keep a fresh copy of the database on your phone and have KeePassDroid remember that location. Then your flow is 1) open KeePassDroid 2) enter password 3) select site 4) copy/paste

Re: 6.5 Million LinkedIn Password Hashes Leaked

#193

Post by tg3 » Wed, Jun 06, 2012, 2:37 PM UTC

ricardobeat wrote: post #145

Smerity wrote: post #115

"We were curious what would happen to our share price if our company did something incredibly stupid" The above comment might seem incredibly harsh, but really, there's no good excuse for a site this prominent to not have a salted, secure password hashing system. Even if they started with an unsalted password system, users can be migrated to the newer more secure system on next login. The only way I could regain resp…

We've just checked everyone's passwords around the office. One of them was in the list, and he has accessed the site the past month.

Could be that he shared a password with another account that hasn't? Wishful thinking most likely.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#194

Post by mletterle » Wed, Jun 06, 2012, 2:37 PM UTC

joelhaasnoot wrote: post #139

Zirro wrote: post #130

Earlier quoted context omitted.

What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?

KeePass works well too - open source, offline solution that has an "Autotype" function. I actually only run into passwords that are a pain on mobile devices. Now that my Android phone has no keyboard but tons of power, that's becoming more and more significant.

You know there's a KeePass app for Android right? I sync my KeePass db between Windows, Linux, and my Android phone using DropBox. Works great.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#195

Post by Aissen » Wed, Jun 06, 2012, 2:37 PM UTC

marbletiles wrote: post #140

Given they haven't confirmed they've found and closed the leak, is it wise for everyone to be changing their passwords already?

Given many people have confirmed that their uniquely generated password is in the list, is it wise to wait any longer before changing your password ?

Re: 6.5 Million LinkedIn Password Hashes Leaked

#196

Post by akrasia » Wed, Jun 06, 2012, 2:38 PM UTC

bstar77 wrote: post #187

I have an ignorant question... when a SHA1 encrypted password is cracked, can the hackers actually identify what the unencrypted password is? I'm guessing no since SHA1 uses a hashing algorithm and only a brute force approach would potentially work...

I'm not an expert in the field but from what I know, SHA1 is a one way function. When an encrypted password is cracked, YES, the hackers know that specific password. They brute forced it by guessing the password, running it through SHA1, and comparing the output to the hash. If they are the same, then they guessed the right password.

They do not know any other passwords and if "salt" was used, they would have to brute force each password. I think salt wasn't used in this case so once they crack someone's password, they know every other user who used the same password. So if you and I used the same password, and they brute forced yours already, they will know that I have the same password.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#197

Post by joeyh » Wed, Jun 06, 2012, 2:39 PM UTC

pilif wrote: post #38

StavrosK wrote: post #24

Can we please start using BrowserID or some other standard so we can secure that one provider and do away with all this? I'd like it if we could authenticate with Google using 2-factor authentication and be less worried about my password getting hacked.

By centralizing authentication, you make that central provider an even bigger target and you risk losing access to other services as you lose your main account (Google is known to sometimes terminate accounts with no way of recurse). Finally, when that central provider gets hacked, all your dependent services are now also compromised. And as we know from the CloudFlare story over the weekend, not even Google with the…

Browserid is not a centralized authentication protocol. Although currently all implementations I know of rely on browserid.org, this is not required by its design.

There's also the fully decentralized openid, you know. I'd 100% rather be able to use openid for sites like Linkedin and this one than rely on every site implementing sane password management.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#198

Post by chli » Wed, Jun 06, 2012, 2:39 PM UTC

jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

If your password was 'linkedinsucks' then it sucks because they found it already !

Re: 6.5 Million LinkedIn Password Hashes Leaked

#199

Post by slig » Wed, Jun 06, 2012, 2:40 PM UTC

kristofferR wrote: post #119

slig wrote: post #90

Earlier quoted context omitted.

Google once forced a password reset for emails/passwords that leaked from a bitcoin forum.

That's easy to do it you have the email addresses, but impossible to do if you only have the SHA-1 hash, as in this case (unless you're also using unsalted SHA-1 hashes, which is a much bigger issue by itself).

Yes, it's technically easy, but it shows everyone how much Google cares.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#200

Post by Splines » Wed, Jun 06, 2012, 2:40 PM UTC

LogicX wrote: post #173

Zirro wrote: post #130

Earlier quoted context omitted.

What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?

This is why I use 1password and not LastPass - the encrypted password file is stored locally - optionally in Dropbox, which is what enables moble and remote (http online through Dropbox) to work. Works excellently!

I use KeePass right now synced with Dropbox - what keeps me up at night is the fact that if the bad guys got my password file today, there could turn out to be a vulnerability in it discovered years from now that could allow them to get my password.