6.5 Million LinkedIn Password Hashes Leaked • Hacker News Board

Re: 6.5 Million LinkedIn Password Hashes Leaked

#201

Post by jgrahamc » Wed, Jun 06, 2012, 2:40 PM UTC

chli wrote: post #198

jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

If your password was 'linkedinsucks' then it sucks because they found it already !

Correct!

  527688fa9f32bb8dab32d30807ca5c57a0b203b8 is not present
  000008fa9f32bb8dab32d30807ca5c57a0b203b8 is present

Re: 6.5 Million LinkedIn Password Hashes Leaked

#202

Post by rmc » Wed, Jun 06, 2012, 2:40 PM UTC

jere wrote: post #89

tazzy531 wrote: post #80

Good Guy Startup Founder would cross reference this password list with their own password system and force those that match to reauthenticate and change their passwords. This wouldn't be difficult to do and your users would appreciate it.

How would one cross-reference this list unless you're storing the plain text passwords?

You can do this if you, like LinkedIn, store SHA1 unsalted passwords. You just look for matches.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#203

Post by Cushman » Wed, Jun 06, 2012, 2:41 PM UTC

Jabbles wrote: post #138

Smerity wrote: post #115

"We were curious what would happen to our share price if our company did something incredibly stupid" The above comment might seem incredibly harsh, but really, there's no good excuse for a site this prominent to not have a salted, secure password hashing system. Even if they started with an unsalted password system, users can be migrated to the newer more secure system on next login. The only way I could regain resp…

Surely just hashing the username|password would massively reduce the effectiveness of leaks like this? Sure, a hacker would know what the "salt" is, but since it now varies between users you would expend the same amount of effort breaking one person's login as you previously would spend breaking everyones (on average). (Not recommending it, just wondering if my reasoning is correct.)

It's true that that would be an improvement, however we try to avoid discussing things like that seriously because of the risk that someone new to the game will actually try to do it. The easy answer is to use an out-of-the-box secure password strategy, anything else is adolescent.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#204

Post by madmaze » Wed, Jun 06, 2012, 2:43 PM UTC

jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

I disagree with #5, I had a few of my coworkers check their sha1 against the DB and most of them were not in the dump. I also checked for truncated hashed, none of which were found. I have the feeling this is a subset of the full database

Re: 6.5 Million LinkedIn Password Hashes Leaked

#205

Post by thaumaturgy » Wed, Jun 06, 2012, 2:44 PM UTC

jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

Hmm. My truncated password (for my now-deleted account) is not in the list of hashes -- so it's not just a uniq'd full DB. Also, the original forum thread where the file was first posted only managed to break around 600,491 passwords before it went offline ... so 3,521,180 broken passwords could mean that the original hacker has had access to some LinkedIn accounts for more than just a few minutes today.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#206

Post by taybenlor » Wed, Jun 06, 2012, 2:46 PM UTC

Smerity wrote: post #176

Jabbles wrote: post #138

Earlier quoted context omitted.

Surely just hashing the username|password would massively reduce the effectiveness of leaks like this? Sure, a hacker would know what the "salt" is, but since it now varies between users you would expend the same amount of effort breaking one person's login as you previously would spend breaking everyones (on average). (Not recommending it, just wondering if my reasoning is correct.)

I hear this commonly, so it is a good idea to clear it up. Usernames have lower entropy than a random salt and are predictable in many cases. People re-use usernames and some usernames are common. If your password system became common on the web, or if I knew the workings of your password system (i.e. open source / leaked codebase / Kerckhoffs's principle[1]), I could generate a rainbow table for either common or tar…

Often people say "Don't roll your own security" but the reality is that developers aren't trying to roll their own. They are trying to solve a problem, and if a quick google doesn't turn up a good library then they'll try and figure it out. Googling for password security implementations is likely to be fraught with horrible horrible advice.

I guess what I'm saying is that it's not enough to say don't do it, instead the defaults need to be there (and very visible).

Re: 6.5 Million LinkedIn Password Hashes Leaked

#207

Post by cjdavis » Wed, Jun 06, 2012, 2:47 PM UTC

It seems we will never get rid of bad programming like this. I hit the 'forgot my password' link on the T-Mobile website yesterday and the pop-up requested my T-Mobile phone number. Ten seconds later I received an SMS with my actual password in it.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#208

Post by toyg » Wed, Jun 06, 2012, 2:48 PM UTC

The good thing is: every time this happens to a high-profile site, storing sensitive data, more people get more acquainted with the concepts of "you really should not use a simple password" and "you really should not use the same password across all sites". I know it works for me: this was the last straw that forced me to abandon a good ol' password I've been using since 1998. From now on I'll just rely on password managers (currently DataVault, but I know people who swear by LastPass).

Re: 6.5 Million LinkedIn Password Hashes Leaked

#209

Post by madmaze » Wed, Jun 06, 2012, 2:50 PM UTC

madmaze wrote: post #204

jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

I disagree with #5, I had a few of my coworkers check their sha1 against the DB and most of them were not in the dump. I also checked for truncated hashed, none of which were found. I have the feeling this is a subset of the full database

on another note,

my fairly complex alphanumeric+symbol password IS in the dump, though not prepended truncated with 0's and the other one I found, which my coworker admitted was too short and alpha only, was in the dump with prepended 0's.

This could validate the fact that the truncated hashes are actually already cracked.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#210

Post by marbletiles » Wed, Jun 06, 2012, 2:51 PM UTC

Aissen wrote: post #195

marbletiles wrote: post #140

Given they haven't confirmed they've found and closed the leak, is it wise for everyone to be changing their passwords already?

Given many people have confirmed that their uniquely generated password is in the list, is it wise to wait any longer before changing your password ?

I guess you need to do both: change your password, but to something throwaway. Then when the hole is closed, change it again.