6.5 Million LinkedIn Password Hashes Leaked • Hacker News Board

Re: 6.5 Million LinkedIn Password Hashes Leaked

#421

Post by dredmorbius » Wed, Jun 06, 2012, 7:46 PM UTC

slavak wrote: post #399

vivekian2 wrote: post #329

Earlier quoted context omitted.

Or you could just feed "sha1 " to the duckduckgo.com search box and it will give the result.

Some people have this thing against sending their private passwords in plaintext to third-party websites...

You're sending the hash, not the password.

DDG supports SSL: https://www.duckduckgo.com/

If you want coverage, generate a few hundred thousand SHA1 hashes along with your password.

Actually, running a trickle query of random SHA1 hashes from your box might be a fun exercise, along with a trickle query of random word tuples (bonus points for using Markov chains to generate statistically probable tuples).

Re: 6.5 Million LinkedIn Password Hashes Leaked

#422

Post by darkarmani » Wed, Jun 06, 2012, 7:47 PM UTC

raverbashing wrote: post #344

carbocation wrote: post #241

Earlier quoted context omitted.

Am not a cryptographer by any means, so please correct me if I'm wrong: If you use any reasonable cost for bcrypt, you're talking hundreds of milliseconds per attempt on a modern CPU. For each 6-character password (since you can't generate a rainbow table) at 100ms per pop, you're talking about something on the order of 2+ years per password divided by the number of CPUs. With something like 900 CPUs running continuo…

I didn't do the math but it sounds right. But suppose tomorrow it takes 10ms. Also, tomorrow, available spaces will increase, so the likelihood of a space vs time tradeoff (even partial) increases WEP was considered "good enough" at first (even though it had obvious problems at first like key size), WAP was considered unbreakable at first, today it's feasible with cloud computing or GPUs. And then we'll be complainin…

I think you are propagating the myth that a scheme can be secure forever.

It's ok if WAP is breakable with cloud computing, because the whole point was to secure it for the next X years so that it takes more than Y dollars to break it. You only need to protect million dollar data enough that it costs 10 million dollars to get it.

If the data is valuable enough and protected heavily enough with crypto, the cheapest way to get it is through a meatspace attack (break-in, abduction, etc).

> WEP was considered "good enough"

Not by security professionals once they saw the effective size of the key. It's the downgrading of what looked like a 64bit key into a 48bit key that was the biggest problem.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#423

Post by SkyMarshal » Wed, Jun 06, 2012, 7:48 PM UTC

icebraining wrote: post #361

sintaks wrote: post #314

Earlier quoted context omitted.

"Which brings us to the most important principle on HN: civility. Since long before the web, the anonymity of online conversation has lured people into being much ruder than they'd dare to be in person. So the principle here is not to say anything you wouldn't say face to face. This doesn't mean you can't disagree. But disagree without calling the other person names. If you're right, your argument will be more convin…

Some people actually do call names to others when face to face. Personally, while I don't, I do tend to get a little aggressive and then I'm often surprised with the backlash, because I get that way when I'm genuinely enjoying the conversation, not when I'm irritated.

Tone doesn't carry on the Internet, so no one knows you're enjoying it. Hence, it generally degrades the quality of the conversation, which is the opposite of what we want at HN.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#424

Post by heliodor » Wed, Jun 06, 2012, 7:50 PM UTC

As much as I hate lawsuits, I'd love to see one or two major Internet companies sued in a class action lawsuit for negligence to serve as an example and a warning to the rest. This kind of behavior from a top tier internet presence is inexcusable!

Re: 6.5 Million LinkedIn Password Hashes Leaked

#425

Post by romaniv » Wed, Jun 06, 2012, 7:50 PM UTC

tptacek wrote: post #377

romaniv wrote: post #330

Earlier quoted context omitted.

We're speaking about a very specific attack here: bruteforce. And I'm speaking about a very specific type of "salt" (which could probably be called something else, since it's not the same as normal unique-per-password salt): large, database-wide string of random bytes. If every password is padded with such a string before hashing, computing the hash would be slower. Obviously, it would be slower because you would hav…

None of this makes much sense to me, sorry. Brute-force password cracking has worked on salted passwords since Alec Muffett released Crack in the early '90s. The amount of extra computational power required to hash a password and a salt is negligible. The only thing "salts" do is prevent rainbow table precomputation, but it's just a quirk of the late '90s and early '00s that "rainbow tables" ever became a mainstream…

Computing a hash on 1MB of data is slower than computing a hash of 6-8 bytes of data. Brute-force attacks are based on trying different passwords and seeing that after being salted they generate the same hash as in the database. Therefore, adding a large string to the password before hashing would force the attacker to hash that string. The question is, can this be pre-computed once or efficiently parallelized?

Re: 6.5 Million LinkedIn Password Hashes Leaked

#426

Post by LogicX » Wed, Jun 06, 2012, 7:51 PM UTC

drivebyacct2 wrote: post #350

swombat wrote: post #98

Am I glad that I use LastPass and have a different, 12-character password for every service? Why, yes, yes, I am. I've now changed my LinkedIn password, too, just in case.

It saddens me that every, single, time this topic comes up, HackerNews, of all places, displays an immense lack of knowledge of current password storage applications, how they work and what value they bring. I think it's really humorous that people feel safe putting an encrypted file in something like Dropbox, but don't trust LastPass (who are doing the exact same thing, everything is local, client side encryption).…

I think the difference you're missing is that LastPass offers the OnlineVault option.

I much prefer the security of being in control of my file, and having its online option controlled by someone else (Dropbox); and logging into Dropbox to then see my passwords 'online' on the go.

If Lastpass.com is compromised, the attacker can MitM compromise my credentials. If 1Password.com is compromised, that is not the case. (Yes, if Dropbox is compromised, they could capture my dropbox credentials, but it would be more difficult for them to then capture my 1password credentials)

Ref: LastPass Online Vault: http://helpdesk.lastpass.com/full.php 1Password Anywhere: http://help.agile.ws/1Password3/1passwordanywhere.html Services I use, and why: http://www.mikeschroll.com/blog/2011/12/07/services-i-use-an...

Re: 6.5 Million LinkedIn Password Hashes Leaked

#427

Post by bandris » Wed, Jun 06, 2012, 7:51 PM UTC

michh wrote: post #333

jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

> Evidence against that thesis is that password of one person that I've asked is not in the list. Mine isn't in it.

Neither is mine.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#428

Post by Hethrir » Wed, Jun 06, 2012, 7:53 PM UTC

Torrent of database: http://www.seedpeer.me/details/4368981/linkedin-hashes.html

Magnet link: magnet:?xt=urn:btih:VUPJHINO4KAWLWVLEKKFWKJVF3DVDDDR

Torrent download: http://www.seedpeer.me/download/linkedin_hashes/ad1e93a1aee2...

Re: 6.5 Million LinkedIn Password Hashes Leaked

#429

Post by Zopieux » Wed, Jun 06, 2012, 7:56 PM UTC

It seems there are some duplicates, considering cracked hashes beginning with 000000. For instance, I found:

  passforlinkedin
  00000610754c30b38d0c70b72b7e8210268cd9b7
  b3534610754c30b38d0c70b72b7e8210268cd9b7

Re: 6.5 Million LinkedIn Password Hashes Leaked

#430

Post by drivebyacct2 » Wed, Jun 06, 2012, 7:56 PM UTC

LogicX wrote: post #426

drivebyacct2 wrote: post #350

Earlier quoted context omitted.

It saddens me that every, single, time this topic comes up, HackerNews, of all places, displays an immense lack of knowledge of current password storage applications, how they work and what value they bring. I think it's really humorous that people feel safe putting an encrypted file in something like Dropbox, but don't trust LastPass (who are doing the exact same thing, everything is local, client side encryption).…

I think the difference you're missing is that LastPass offers the OnlineVault option. I much prefer the security of being in control of my file, and having its online option controlled by someone else (Dropbox); and logging into Dropbox to then see my passwords 'online' on the go. If Lastpass.com is compromised, the attacker can MitM compromise my credentials. If 1Password.com is compromised, that is not the case. (Y…

>I much prefer the security of being in control of my file, and having its online option controlled by someone else (Dropbox); and logging into Dropbox to then see my passwords 'online' on the go.

You can't even do that. You have to install a local client. Download the file, open it in your new client, edit it, manually reupload it. If you don't want to use the on-web LastPass vault, then don't, but it's still doing local decryption and you can still used the signed Chrome extensions to carry out ops if you don't trust LastPass.com proper.

>If Lastpass.com is compromised, the attacker can MitM compromise my credentials.

Which part of "local, client-side encryption" is confusing?

edit: 1PassAnywhere is the exact same thing as what LastPass is doing with it's LastPass.com-served Vault.

edit2: There's even multifactor auth available for it and the Online Vault feature.