Here are a couple links to the file:
http://www.mediafire.com/?n307hutksjstow3 (RAR)
https://disk.yandex.net/disk/public/?hash=pCAcIfV7wxXCL/YPhO... (ZIP)
6.5 Million LinkedIn Password Hashes Leaked
311–320 of 547 posts
Re: 6.5 Million LinkedIn Password Hashes Leaked
#312Earlier quoted context omitted.
Obligatory perl one-liner: perl -MDigest::SHA -le '$h = substr( Digest::SHA::sha1_hex($ARGV[0]) , 5 ); open F, " )' password (for people without shells)
Obligatory shell one-liner: grep `echo -n password | shasum | cut -c6-40` hacked.txt
Prefix the whole command with a space to avoid dumping your password into your bash history:
" grep `echo -n yourpassword | shasum | cut -c6-40` SHA1.txt"
Re: 6.5 Million LinkedIn Password Hashes Leaked
#313Maybe they read this SO thread?
http://stackoverflow.com/questions/2019279/what-is-the-recom...
Re: 6.5 Million LinkedIn Password Hashes Leaked
#314Earlier quoted context omitted.
That's a trivial modification: $ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log(x.substring(5));" | xargs -I {} grep {} hashes.txt I'm surprised at the backlash to what I thought was fun code golfing. No one called me names after I posted a simple Python solution that didn't check the file. For what it's worth I've changed my LI password…
My point still stands. There's funny and then theres blatent fanboyism. You're like a prepubescent teenager who doesn't understand the context of social situations so always says something stupid.
"Which brings us to the most important principle on HN: civility. Since long before the web, the anonymity of online conversation has lured people into being much ruder than they'd dare to be in person. So the principle here is not to say anything you wouldn't say face to face. This doesn't mean you can't disagree. But disagree without calling the other person names. If you're right, your argument will be more convincing without them."
Re: 6.5 Million LinkedIn Password Hashes Leaked
#315Earlier quoted context omitted.
The big difference between "hosted service" and "encrypted file in the cloud" is that the hosted service has, by definition, to store the key next to the lock to be practical. The key for your encrypted file stays in your head (and/or in your wallet), so even a full-on total breach of Dropbox/iCloud, your key is safe, and 8 million rounds of 265-bit AES and a good password (my current KeePass settings) is still unbre…
Why can't the hosted service use an "encrypted file in the cloud" as its implementation? As long as it requires client-side code to do the decryption, the key stays in your head alone.
I believe this is exactly how LastPass is implemented.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#316Um, pardon the obvious question, but does someone have a direct link to the hash file?
From a slashdot comment: https://disk.yandex.net/disk/public/?hash=pCAcIfV7wxXCL/YPhO...
Thanks.
For anyone trying: it's not a direct link, but a download page (JS required) which lets you d/l "combo_not.zip". Which has 6458020 lines of "00000"-prefixed hashes, apparently sorted.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#317The SHA1 of my LinkedIn password naturally starts with "00000". I wonder if that would have thwarted the original cracking attempt.
I'm almost disappointed that mine was not in the list.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#318Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…
Another data point: I changed my linkedin password about three weeks ago. The old one is in the list (already 00000-ed), the new one isn't.
My (very unique) password hash is in the list, although unbroken so far.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#319Earlier quoted context omitted.
Nothing, really. However, I trust the LastPass guys to keep their shit secure as much as I trust myself to keep my own system secure. After all, if my own system is compromised, I just get a lot of hassle. If LastPass ever gets hacked and leaks their passwords, they lose their business overnight. That's pretty good motivation for them to keep on top of their stuff. I used to use 1Passwd, which stored the passwords in…
The big difference between "hosted service" and "encrypted file in the cloud" is that the hosted service has, by definition, to store the key next to the lock to be practical. The key for your encrypted file stays in your head (and/or in your wallet), so even a full-on total breach of Dropbox/iCloud, your key is safe, and 8 million rounds of 265-bit AES and a good password (my current KeePass settings) is still unbre…
As far as I know, LastPass does not "store the key next to the lock."[1] The browser extension encrypts/decrypts locally. If you use your password file through the web site you're still downloading your encrypted DB from them and encrypting/decrypting locally (whether with the extension, or I believe they also have a pure JS implementation).
[1] Or so they say. I've never MITMed their SSL, and their software is not open source AFAIK. This is not to say someone couldn't e.g. distribute a trojaned version of their browser extensions. If you poke around the developer(s) have at least revealed the encryption method for the your DB so you can verify how it is encrypted for yourself, which is a good sign if nothing else.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#320Earlier quoted context omitted.
Why can't the hosted service use an "encrypted file in the cloud" as its implementation? As long as it requires client-side code to do the decryption, the key stays in your head alone.
I believe this is exactly how LastPass is implemented.
Ugh, you're right. Well, then there's no discernible difference between LastPass and KeePass with the DB on Dropbox.