291–300 of 547 posts
Am I glad that I use LastPass and have a different, 12-character password for every service? Why, yes, yes, I am. I've now changed my LinkedIn password, too, just in case.
What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?
Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…
I've had the same password on linkedin for as long as I remember and neither the full hash nor the zero prefix edited was found in the dump. Simple line used in OS X terminal: grep -e "`echo -n "your pass" | openssl sha1`" combo_not.txt
i=`echo -n 'mypass' |openssl sha1 |echo ${i:14}`; grep $i combo_not.txt
This yielded success on some known passwords and a bunch of obvious passwords. Not mine, but I assume this dump is a list of the passwords they've cracked so far (i.e., even if your password isn't on this list - change it).
Good Guy Startup Founder would cross reference this password list with their own password system and force those that match to reauthenticate and change their passwords. This wouldn't be difficult to do and your users would appreciate it.
Earlier quoted context omitted.
I'm even happier I don't have a LinkedIn account.
I've been tempted to delete mine several times recently. Looks like now is the moment.
Having a fictional LinkedIn account can be amusing.
> - With a computer of 8,000 NOK (~ 1400 USD), you can do a few hundred million attempts per second. Are you kidding me? LinkedIn stored their passwords using (salted) SHA1 using no iterations? Jesus.
To expand on that, to store passwords don't just use salt+sha1, or try to do your own nested sha1, just use bcrypt: http://en.wikipedia.org/wiki/Bcrypt
Earlier quoted context omitted.
And.. the node.js solution doesn't do what either the Perl or shell one liners do. It doesn't tell you whether the password was found in the file. All it does is print out a SHA1 hash of a string.
That's a trivial modification: $ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log(x.substring(5));" | xargs -I {} grep {} hashes.txt I'm surprised at the backlash to what I thought was fun code golfing. No one called me names after I posted a simple Python solution that didn't check the file. For what it's worth I've changed my LI password…
Earlier quoted context omitted.
To expand on that, to store passwords don't just use salt+sha1, or try to do your own nested sha1, just use bcrypt: http://en.wikipedia.org/wiki/Bcrypt
I wonder, why do people saying "just use bcrypt" never, ever bother to elaborate on what benefits it has, and which of them are relevant to the subject of the conversation? Believing in some function without understanding implications of its use does very little for real security.
Earlier quoted context omitted.
And.. the node.js solution doesn't do what either the Perl or shell one liners do. It doesn't tell you whether the password was found in the file. All it does is print out a SHA1 hash of a string.
That's a trivial modification: $ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log(x.substring(5));" | xargs -I {} grep {} hashes.txt I'm surprised at the backlash to what I thought was fun code golfing. No one called me names after I posted a simple Python solution that didn't check the file. For what it's worth I've changed my LI password…
Password: "needajob"
Hash: e41b635974babd5d6e7d6dc68e8b3d2fc39938b2
Cracked: 0000035974babd5d6e7d6dc68e8b3d2fc39938b2