Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6.5 Million LinkedIn Password Hashes Leaked

translate.google.com

Post reply on HN
Print view View original

361–370 of 547 posts

Re: 6.5 Million LinkedIn Password Hashes Leaked

#361

Post by icebraining »

sintaks wrote: post #314
zxcvb wrote: post #296

Earlier quoted context omitted.

My point still stands. There's funny and then theres blatent fanboyism. You're like a prepubescent teenager who doesn't understand the context of social situations so always says something stupid.

"Which brings us to the most important principle on HN: civility. Since long before the web, the anonymity of online conversation has lured people into being much ruder than they'd dare to be in person. So the principle here is not to say anything you wouldn't say face to face. This doesn't mean you can't disagree. But disagree without calling the other person names. If you're right, your argument will be more convin…

Some people actually do call names to others when face to face.

Personally, while I don't, I do tend to get a little aggressive and then I'm often surprised with the backlash, because I get that way when I'm genuinely enjoying the conversation, not when I'm irritated.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#362

Post by rasengan »

olifante wrote: post #312
jgrahamc wrote: post #224

Earlier quoted context omitted.

Obligatory shell one-liner: grep `echo -n password | shasum | cut -c6-40` hacked.txt

Prefix the whole command with a space to avoid dumping your password into your bash history: " grep `echo -n yourpassword | shasum | cut -c6-40` SHA1.txt"

I couldn't really find a good reason to use a .bash_history. I linked mine to /dev/null and never looked back. (heh)

Re: 6.5 Million LinkedIn Password Hashes Leaked

#364

Post by jneal »

My password isn't in the file, and yes I checked for a 0'd version as well. My password is 9 characters of lower case, upper case, numbers, and a symbol. I'm wondering if this is incomplete, or fake. Either way...if it is a vulnerability I suppose LinkedIn hasn't fixed it yet, or at least I haven't heard mention of this - thus even changing your password won't help much if they can just re-download the database. Thus making a long, complex password is the best course of action.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#365

Post by romaniv »

Symmetry wrote: post #252
dchest wrote: post #227

Earlier quoted context omitted.

Because the answer to your question is one Google search away. HN people are tired of explaining it every single time bcrypt comes up.

Also, there's already an answer in the thread http://news.ycombinator.com/item?id=4073839

It's not an in-depth answer. It does not say, for example, why bcrypt is more secure than nested SHA1. (I believe it has to do with the possibility to efficiently implement SHA algorithms in GPUs.)

People are using unsalted SHA1, because someone told them in the past "just use sha1". Now someone else tells them "just use BCrypt". Without understanding why, it's nearly impossible to to decide which security policy is sensible. There are many different types of advice competing for attention, and not all of them are good.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#366

Post by pjscott »

raverbashing wrote: post #344
carbocation wrote: post #241

Earlier quoted context omitted.

Am not a cryptographer by any means, so please correct me if I'm wrong: If you use any reasonable cost for bcrypt, you're talking hundreds of milliseconds per attempt on a modern CPU. For each 6-character password (since you can't generate a rainbow table) at 100ms per pop, you're talking about something on the order of 2+ years per password divided by the number of CPUs. With something like 900 CPUs running continuo…

I didn't do the math but it sounds right. But suppose tomorrow it takes 10ms. Also, tomorrow, available spaces will increase, so the likelihood of a space vs time tradeoff (even partial) increases WEP was considered "good enough" at first (even though it had obvious problems at first like key size), WAP was considered unbreakable at first, today it's feasible with cloud computing or GPUs. And then we'll be complainin…

The time bcrypt takes is configurable, so in the future you can adjust the amount of work per password -- this is literally a one-character change in your code -- and be alright again. Ditto for the rest of the decent password hashing schemes.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#367

Post by K2h »

swombat wrote: post #98

Am I glad that I use LastPass and have a different, 12-character password for every service? Why, yes, yes, I am. I've now changed my LinkedIn password, too, just in case.

I'm worried in a few years LastPass could become a target, and now instead of someone having a password that 'could' be shared among your multiple accounts, you have now given the complete keys to the city by listing all of your logons great and small in a central repository.

This central repository then becomes a very appealing target.

I say this as a LastPass user, as I think it is the best of the current offerings, but I'm uncertain how to shield this huge central list. I wish it had multiple logon PW so that you could at least segment the risk and reduce the time the high PW is used to when you really need it.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#368

Post by peterwwillis »

prakashk wrote: post #326
peterwwillis wrote: post #213

Earlier quoted context omitted.

Obligatory perl one-liner: perl -MDigest::SHA -le '$h = substr( Digest::SHA::sha1_hex($ARGV[0]) , 5 ); open F, " )' password (for people without shells)

Shorter and, IMHO, a bit simpler Perl one-liner: perl -MDigest::SHA=sha1_hex -le '$h = substr( sha1_hex(shift), 5 ); open F, " ' password Or: perl -MDigest::SHA=sha1_hex -lne 'BEGIN {$pw = shift} $h = substr( sha1_hex($pw), 5 ); print "found $_" if /$h/' password combo_not.txt

The first one ramps up memory use like crazy (which I was trying to avoid) and the second one is much better with memory, but you need to move the sha1_hex into the BEGIN block or you're recomputing the hash for every line parsed, thrashing your CPU. Interesting use of 'shift' though, I didn't know you could modify the file argument to -n like that.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#369

Post by mahyarm »

A password I used many months ago (maybe almost a year now?) was in the list, but the password I use currently for many months was not on the list interestingly enough. This list is possibly pretty old, which means it happened quite a while ago.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#370

Post by peterwwillis »

olifante wrote: post #312
jgrahamc wrote: post #224

Earlier quoted context omitted.

Obligatory shell one-liner: grep `echo -n password | shasum | cut -c6-40` hacked.txt

Prefix the whole command with a space to avoid dumping your password into your bash history: " grep `echo -n yourpassword | shasum | cut -c6-40` SHA1.txt"

Alternative and more dramatic method of preventing it being written to your bash history:

  kill -9 $$
Post reply on HN