Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6.5 Million LinkedIn Password Hashes Leaked

translate.google.com

Post reply on HN
Print view View original

381–390 of 547 posts

Re: 6.5 Million LinkedIn Password Hashes Leaked

#381

Post by joshz »

jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

Mine was not in the list. It's also possible this isn't the entire file. I was also able to recover 225129 other passwords with a wordfile and some Python based on truncated and full hashes.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#382

Post by StavrosK »

drivebyacct2 wrote: post #351
StavrosK wrote: post #24

Can we please start using BrowserID or some other standard so we can secure that one provider and do away with all this? I'd like it if we could authenticate with Google using 2-factor authentication and be less worried about my password getting hacked.

Wow. Not only is every single reply to StavrosK completely wrong about how BrowserID works, they're actually doubly wrong. Not only is it NOT centralized, it also can be used with: - 2 factor auth - asymmetric encryption (aka, a challenge/response ala PGP) - whatever security mechanism you want, frankly. It's up to the browserid provider.

My rationale is that it's much easier to secure one provider (the attack surface is much smaller), and you can also run one yourself, making you responsible for all your authentication needs.

OpenID was great in that you could choose any provider you wanted, and nobody could attack them all (not that they'd have to). It just seems like a good solution to use someone whose only job is to provide secure authentication.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#383

Post by eidorianu »

dpritchett wrote: post #183
jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

For the security novices amongst us: I had no idea how to do this so I figured out a quick python script to test it: >>> from hashlib import sha1 >>> def check_pass(plaintext, offset=5): hashed = sha1(plaintext).hexdigest() return (hashed, '0' * offset + hashed[offset:]) >>> check_pass("linkedin") ('7728240c80b6bfd450849405e8500d6d207783b6', '0000040c80b6bfd450849405e8500d6d207783b6') Edit: I'm pretty sure JtR refers…

Any password that I try works...

Re: 6.5 Million LinkedIn Password Hashes Leaked

#384

Post by eidorianu »

riffraff wrote: post #232
jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

fwiw, this could also be an elaborate hoax, given this facts. E.g. a list of simple password + combinations of the above simple password+"linkedin" variations.

I agree, I've tried several passwords and they match. If you're a Math person, please shed some light on the chances that this list covers the full space.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#385

Post by nupark2 »

madmaze wrote: post #209
madmaze wrote: post #204

Earlier quoted context omitted.

I disagree with #5, I had a few of my coworkers check their sha1 against the DB and most of them were not in the dump. I also checked for truncated hashed, none of which were found. I have the feeling this is a subset of the full database

on another note, my fairly complex alphanumeric+symbol password IS in the dump, though not prepended truncated with 0's and the other one I found, which my coworker admitted was too short and alpha only, was in the dump with prepended 0's. This could validate the fact that the truncated hashes are actually already cracked.

Mine was 5 characters, alpha and numeric, but no special characters. It was in there, prepended with 0's.

Whoops.

At the very least, it should have been longer.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#386

Post by re_todd »

fluidcruft wrote: post #165

Can anyone tell me where I can change my password on LinkedIn? I must be dense.

Assuming LinkedIn used SHA1 unsalted passwords and will continue to do so, and many of us do not want to delete our LinkedIn accounts, what should be the minimum number of characters we should use in our new password? 15? 20? 100? (I know, 100 is probably higher than they allow)

Re: 6.5 Million LinkedIn Password Hashes Leaked

#387

Post by perinteger »

jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

Got a link to the file? I haven't been able to dig one up

Re: 6.5 Million LinkedIn Password Hashes Leaked

#388

Post by ionwake »

dpritchett wrote: post #260
jgrahamc wrote: post #224

Earlier quoted context omitted.

Obligatory shell one-liner: grep `echo -n password | shasum | cut -c6-40` hacked.txt

Here's node.js: $ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log([x, '00000' + x.substring(5)]);" 7728240c80b6bfd450849405e8500d6d207783b6 0000040c80b6bfd450849405e8500d6d207783b6

Hi - what does

" xargs node -e "

do?

Thank you

Re: 6.5 Million LinkedIn Password Hashes Leaked

#390

Post by Estragon »

jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

So where is the list? I'd like to see whether I'm on it.
Post reply on HN