Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6.5 Million LinkedIn Password Hashes Leaked

translate.google.com

Post reply on HN
Print view View original

341–350 of 547 posts

Re: 6.5 Million LinkedIn Password Hashes Leaked

#341

Post by freyr »

zxcvb wrote: post #296
dpritchett wrote: post #281

Earlier quoted context omitted.

That's a trivial modification: $ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log(x.substring(5));" | xargs -I {} grep {} hashes.txt I'm surprised at the backlash to what I thought was fun code golfing. No one called me names after I posted a simple Python solution that didn't check the file. For what it's worth I've changed my LI password…

My point still stands. There's funny and then theres blatent fanboyism. You're like a prepubescent teenager who doesn't understand the context of social situations so always says something stupid.

"You're like a prepubescent teenager who doesn't understand the context of social situations..."

The hypocrisy is so unabashed my brain might explode.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#342

Post by docubot »

mcculley wrote: post #334

I can confirm that my password was in there. I have changed it. My password was "98mnja6z" which hashes to 6475590bc1407aa98c8b022230292cce3d8528b3. I used this for no other sites, so I'm not concerned about it leaking. It is inexcusable that LinkedIn hasn't alerted their users yet.

Mine is also in there. It was also a randomly generated password used only on LinkedIn.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#344

Post by raverbashing »

carbocation wrote: post #241
raverbashing wrote: post #122

Earlier quoted context omitted.

Like you can't break bcrypt... The weakest link, either in bcrypt or MD5 is the password quality. Of course, in pure MD5 today you're a google search away and modern computers can eat salted MD5 for breakfast But the easiest passwords are going to be broken first

Am not a cryptographer by any means, so please correct me if I'm wrong: If you use any reasonable cost for bcrypt, you're talking hundreds of milliseconds per attempt on a modern CPU. For each 6-character password (since you can't generate a rainbow table) at 100ms per pop, you're talking about something on the order of 2+ years per password divided by the number of CPUs. With something like 900 CPUs running continuo…

I didn't do the math but it sounds right.

But suppose tomorrow it takes 10ms. Also, tomorrow, available spaces will increase, so the likelihood of a space vs time tradeoff (even partial) increases

WEP was considered "good enough" at first (even though it had obvious problems at first like key size), WAP was considered unbreakable at first, today it's feasible with cloud computing or GPUs.

And then we'll be complaining on HN that they didn't use xyzcrypt or something instead of bcrypt.

" it seems to me that leaking non-salted SHA1 hashes is virtually the worst case disaster scenario"

Yes. Salt is password storage 101!

Re: 6.5 Million LinkedIn Password Hashes Leaked

#345

Post by drewfrank »

statictype wrote: post #303

I literally created my LinkedIn account only 2 days ago. And my password was in the list and cracked. Thankfully I don't use it for anything else.

Is it unique enough that you can be sure it's your password, and not someone else's? I ask because the cracked passwords seem to be the simple/obvious ones that are likely to be used by multiple people. If it is strong/unique though, it would effectively confine the hack time to the last 2 days.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#346

Post by andreyf »

rfugger wrote: post #318
lt wrote: post #286

Earlier quoted context omitted.

Another data point: I changed my linkedin password about three weeks ago. The old one is in the list (already 00000-ed), the new one isn't.

My (very unique) password hash is in the list, although unbroken so far.

Sorry for the stupid question, but where did you guys find the list of hashes? I didn't see it linked in the article.

Edit: found it in the Slashdot comments, it's: http://www.mediafire.com/?n307hutksjstow3

For the record, my password's hash was not in the list.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#347

Post by jpeavy1 »

llimllib wrote: post #251
lemming wrote: post #144

Earlier quoted context omitted.

I've been tempted to delete mine several times recently. Looks like now is the moment.

You're free to hit "delete" on linkedin, but there's a very high likelihood that it will only mean "hide my profile". Anyone who got your user/pass would probably be able to reinstantiate your account and do anything to it they wanted.

agree; don't just delete, suicidemachine.org

Re: 6.5 Million LinkedIn Password Hashes Leaked

#348

Post by leot »

madmaze wrote: post #204
jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

I disagree with #5, I had a few of my coworkers check their sha1 against the DB and most of them were not in the dump. I also checked for truncated hashed, none of which were found. I have the feeling this is a subset of the full database

Mine is there.

(email me if you need proof)

Re: 6.5 Million LinkedIn Password Hashes Leaked

#350

Post by drivebyacct2 »

swombat wrote: post #98

Am I glad that I use LastPass and have a different, 12-character password for every service? Why, yes, yes, I am. I've now changed my LinkedIn password, too, just in case.

It saddens me that every, single, time this topic comes up, HackerNews, of all places, displays an immense lack of knowledge of current password storage applications, how they work and what value they bring.

I think it's really humorous that people feel safe putting an encrypted file in something like Dropbox, but don't trust LastPass (who are doing the exact same thing, everything is local, client side encryption). Especially when you're missing out on all of the benefits of browser integration.

Please, take a whole 3 minutes and do a tiny bit of research. Your future self will thank you when people like swombat and myself get to laugh at LinkedIn, change our passwords and never think about it again.

Post reply on HN