Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LeakedIn

leakedin.org

Post reply on HN
Print view View original

51–60 of 194 posts

Re: LeakedIn

#51

Post by paulhodge »

jperras wrote: post #36
paulhodge wrote: post #27

Earlier quoted context omitted.

Still, hashes can be cracked, and an evil password-checking website can then associate the password with all of the other personally-identifiable data that browsers are known to leak. I don't think this particular site is being evil, but it would be wrong for a user to trust a site like this.

Again, you can check the source. It's a single page for a reason ;-). There's no trickery hidden in there.

I mean server-side (can we check the source for that?). The server could crack the hash, and the server could use various pieces of data (ip address, http headers, etc) to try to figure out more about the password's owner.

Re: LeakedIn

#52

Post by raverbashing »

eddieplan9 wrote: post #47

I made something almost the same (including name!), except all check is done in browser: http://crackedin.s3-website-us-east-1.amazonaws.com/ And it's hosted on S3 so it is faster :)

I just wanted the list in an easily downloadable format so I can check offline

(easily downloadable == not the rapidshare of russia, something you could wget)

But I submitted the hash of my password and it's there so...

Re: LeakedIn

#54

Post by wouterinho »

eddieplan9 wrote: post #47

I made something almost the same (including name!), except all check is done in browser: http://crackedin.s3-website-us-east-1.amazonaws.com/ And it's hosted on S3 so it is faster :)

Interesting implementation, but won't this eat up a lot of bandwidth and cause a high S3 bill?

Re: LeakedIn

#55

Post by obituary_latte »

hung wrote: post #26

I quickly wrote a script to do this locally, not the most efficient, but I'm at work ;) https://github.com/hungtruong/LinkedIn-Password-Checker

Thank you. Worked for me as well...

I wonder what kind of bonkers executive at LI decided it would not be a good idea to do a sweeping wipe of all passwords on their systems...

    for user in users:
      force_pw_reset(user);

    def force_pw_reset(user):
      user.pw = rand;
      user.sendResetEmail();
(note to LI: this isn't real code; don't use)

Re: LeakedIn

#56

Post by its_so_on »

Sorry, I don't mean to be harsh, but this concept is pretty much dead on arrival.

"Check if your hash is still private and secure by sending us your hash."

Well, even if the hash was secure, it isn't now!

(Unless you:

O get the whole database into the client

O ask the user to:

o reload the URL in PRIVATE browsing mode

o DISCONNECT from the network

o test the results with javascript

o close the whole browser

o reopen the browser

o finally, clear flash cookies (how do I even do that?)

o Only then reconnect to the network

All to prevent you from either reading the results afterward or, as regards instructions to disconnect from the network, somehow changing or making a mistake in the javascript, perhaps after we or others have verified and ok'd it.)

If the only answer to the objection against giving you the hash is that you don't ask for the username, you might as well ask for the password plaintext.

Sorry, the concept is pretty much dead on arrival.

Still, way to ship. (or 'nice shipping.' Should be our secret handshake :). Good luck on the next concept.

Re: LeakedIn

#57

Post by raverbashing »

pbreit wrote: post #8

Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.

In other news I have a startup on credit card security

Just submit your credit card number, CVV2 and expiration date and it'll check if it has been stolen over the internet for you

Re: LeakedIn

#58

Post by mrmaddog »

pbreit wrote: post #8

Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.

If you don't particularly trust the included click.js script, you can generate your password's SHA-1 via python fairly easily

   python -c 'import hashlib; print hashlib.sha1("PaSSw0rd").hexdigest()'

Re: LeakedIn

#59

Post by cschmidt »

nailer wrote: post #30
jeffgreco wrote: post #9

Earlier quoted context omitted.

You can provide your own hash, and a quick source check reveals that plaintext is being converted into a hash client-side, so only hashed data is being sent to the server.

I think it'd be best to provide people with a simple way to generate their hash with a well-known tool they already trust - eg, an openssl command.

For the record, on a Mac, save your password in a text file called password, without a return at the end of the line. Then:

openssl dgst -sha1 password

will give you the hash you need. Mine has been leaked but not cracked, according to this site :-(.

Re: LeakedIn

#60

Post by simoncion »

joshuahedlund wrote: post #4

Mine was not in the list. I had a non-dictionary password with letters and numbers, 8 characters, and it was at least several months old. (If we can collect enough data points of whose passwords are on it or not, how old they are, and how complex the password was, we should be able to narrow down a potential date range for the list and the odds that the compromised list is full or partial.)

My autogenerated password was not on the list. It was generated back in late 2010.
Post reply on HN