LeakedIn • Hacker News Board

Re: LeakedIn

#21

Post by kungfooey » Wed, Jun 06, 2012, 7:14 PM UTC

fendrak wrote: post #5

One suggestion: make the input box have a type of 'password'. I was only a bit put-off by seeing my plaintext password staring me in the face!

Probably a good thing since it makes you think twice about submitting your plain-text password to an unknown entity.

Re: LeakedIn

#22

Post by ig1 » Wed, Jun 06, 2012, 7:15 PM UTC

The site should tell people to change their password anyway regardless of whether it's in the list or not.

Re: LeakedIn

#23

Post by Splines » Wed, Jun 06, 2012, 7:16 PM UTC

jes5199 wrote: post #18

yipes - apparently that site sends up an unsalted sha1 of your password. If leaked unsalted sha1s are worth being worried about, then typing your password into this site is just as bad as the original leak

Like others have stated, you should assume your password hash was leaked anyway. Change it first, then put in the old password into this tool for curiosity's sake.

Re: LeakedIn

#24

Post by Splines » Wed, Jun 06, 2012, 7:16 PM UTC

We need a "wasmylinkedinpasswordleaked.com" with yes as the content.

Re: LeakedIn

#25

Post by [deleted] » Wed, Jun 06, 2012, 7:17 PM UTC

[deleted]

Re: LeakedIn

#26

Post by hung » Wed, Jun 06, 2012, 7:17 PM UTC

I quickly wrote a script to do this locally, not the most efficient, but I'm at work ;)

https://github.com/hungtruong/LinkedIn-Password-Checker

Re: LeakedIn

#27

Post by paulhodge » Wed, Jun 06, 2012, 7:19 PM UTC

jperras wrote: post #12

pbreit wrote: post #8

Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.

You can supply just your password hash if you want, and if you supply the raw password, it's hashed client-side via Javascript before being sent to the server. Test it out with firebug and a dummy password if you're not keen on wading through the source.

Still, hashes can be cracked, and an evil password-checking website can then associate the password with all of the other personally-identifiable data that browsers are known to leak. I don't think this particular site is being evil, but it would be wrong for a user to trust a site like this.

Re: LeakedIn

#28

Post by anon01 » Wed, Jun 06, 2012, 7:21 PM UTC

I think its interesting to see what kind of passwords were in there. "password" was of course in there, "password1" was not, "password2" was....

Re: LeakedIn

#29

Post by ConstantineXVI » Wed, Jun 06, 2012, 7:22 PM UTC

thrill wrote: post #10

jeffgreco wrote: post #9

Earlier quoted context omitted.

You can provide your own hash, and a quick source check reveals that plaintext is being converted into a hash client-side, so only hashed data is being sent to the server.

'password' was actually in use - go figure.

As is

    ********

Re: LeakedIn

#30

Post by nailer » Wed, Jun 06, 2012, 7:23 PM UTC

jeffgreco wrote: post #9

sontek wrote: post #7

I think its safer to test yourself than randomly typing your password in on websites =)

You can provide your own hash, and a quick source check reveals that plaintext is being converted into a hash client-side, so only hashed data is being sent to the server.

I think it'd be best to provide people with a simple way to generate their hash with a well-known tool they already trust - eg, an openssl command.