Genius. LinkedIn needs more of you apparently.
LeakedIn
31–40 of 194 posts
Re: LeakedIn
#32There is a tracking service on the results page keep sending out everything you've just submited.
Re: LeakedIn
#33You could use the service to see if your new password was already hacked..
Re: LeakedIn
#34You should add a note on the page that lets people know that checking a password takes a minute or two. EDIT: Actually never mind, seems like it's much faster now.
Yeah. We got hit pretty hard. It doesn't actually take a minute or two, unless you're doing a few hundred at the same time. Fixing. (-:
Can you confirm you're not logging/recording the hashed passwords?
Re: LeakedIn
#35Beat me to my more tounge-in-cheek http://ismylinkedinpasswordleaked.com ;)
Re: LeakedIn
#36Earlier quoted context omitted.
You can supply just your password hash if you want, and if you supply the raw password, it's hashed client-side via Javascript before being sent to the server. Test it out with firebug and a dummy password if you're not keen on wading through the source.
Still, hashes can be cracked, and an evil password-checking website can then associate the password with all of the other personally-identifiable data that browsers are known to leak. I don't think this particular site is being evil, but it would be wrong for a user to trust a site like this.
Again, you can check the source. It's a single page for a reason ;-). There's no trickery hidden in there.
Re: LeakedIn
#37Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
My password is 'password1' and it's on that list... Yikes.
Re: LeakedIn
#38Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
hunter2
Re: LeakedIn
#39Earlier quoted context omitted.
Yeah. We got hit pretty hard. It doesn't actually take a minute or two, unless you're doing a few hundred at the same time. Fixing. (-:
Can you confirm you're not logging/recording the hashed passwords?
We can tell you we're not, but that doesn't actually confirm anything. (We're really not, though.)
To be safe, you should consider the SHA-1 hash of your LinkedIn password to be public, even if it's not one of these 6.5 million.