How about submitting the hashes over https, at the very least somebody could be sniffing the traffic from your site and gathering the hash list for themselves..
LeakedIn
11–20 of 194 posts
Re: LeakedIn
#12Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
You can supply just your password hash if you want, and if you supply the raw password, it's hashed client-side via Javascript before being sent to the server. Test it out with firebug and a dummy password if you're not keen on wading through the source.
Re: LeakedIn
#13[deleted]
Re: LeakedIn
#14Mine was not in the list. I had a non-dictionary password with letters and numbers, 8 characters, and it was at least several months old. (If we can collect enough data points of whose passwords are on it or not, how old they are, and how complex the password was, we should be able to narrow down a potential date range for the list and the odds that the compromised list is full or partial.)
You're confusing "not on the list" with "not in the hacker's possession".
Re: LeakedIn
#15Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
Even if you don't check the source code to verify that it's harmless, you should assume your password has been compromised and have already changed it anyway. This just lowers the cost of checking the list and could help us learn more about the compromise.
Re: LeakedIn
#16Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
Just change your password before checking. You should've had already, anyway.
Re: LeakedIn
#17"Your password was leaked and cracked. Sorry, friend."
Well that's lovely. Just changed my LinkedIn password so hopefully no one had a chance to take advantage of that. Luckily I very recently switched to a new password scheme so my other accounts should be secure too.
Re: LeakedIn
#18yipes - apparently that site sends up an unsalted sha1 of your password. If leaked unsalted sha1s are worth being worried about, then typing your password into this site is just as bad as the original leak
Re: LeakedIn
#19Mine was not in the list. I had a non-dictionary password with letters and numbers, 8 characters, and it was at least several months old. (If we can collect enough data points of whose passwords are on it or not, how old they are, and how complex the password was, we should be able to narrow down a potential date range for the list and the odds that the compromised list is full or partial.)
You're confusing "not on the list" with "not in the hacker's possession".
Not necessarily. There are two possibilities we can analyze:
1. "not on the list" means "not in the hacker's possession". In other words, the compromised list is partial.
2. "not on the list" means hacker already has cracked it and didn't post for help.
Learning more about the kinds of passwords not on the list could help us determine which scenario is more likely. (If lots of complex passwords are not on the list, that is evidence the compromised list is partial. If only simple passwords or passwords of a certain pattern are not on the list, that is evidence the compromised list is complete and passwords that were already cracked were not posted.)
Re: LeakedIn
#20My autogenerated password was in the list, and not cracked.
I've changed it anyway on linkedin.