Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6.5 Million LinkedIn Password Hashes Leaked

translate.google.com

Post reply on HN
Print view View original

441–450 of 547 posts

Re: 6.5 Million LinkedIn Password Hashes Leaked

#441

Post by pbhjpbhj »

shill wrote: post #271
jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

I have found hashes of linkedout, recruiter, recru1ter, googlerecruiter, toprecruiter, superrecruiter, humanresources and hiring. If it is a hoax, it is a very elaborate hoax.

Perhaps it's a DDoS on MediaFire! /joke

Re: 6.5 Million LinkedIn Password Hashes Leaked

#442

Post by biot »

JoshTriplett wrote: post #433
biot wrote: post #373

Earlier quoted context omitted.

I assume the first line you meant to pipe it through uniq afer the sort? Otherwise the only thing you've demonstrated is that sorting a file doesn't change its line count. :)

"sort -u" means "sort and uniq".

Wow, I can't believe I was never aware of this. Thank you!

Re: 6.5 Million LinkedIn Password Hashes Leaked

#443

Post by zxcvb »

sintaks wrote: post #314
zxcvb wrote: post #296

Earlier quoted context omitted.

My point still stands. There's funny and then theres blatent fanboyism. You're like a prepubescent teenager who doesn't understand the context of social situations so always says something stupid.

"Which brings us to the most important principle on HN: civility. Since long before the web, the anonymity of online conversation has lured people into being much ruder than they'd dare to be in person. So the principle here is not to say anything you wouldn't say face to face. This doesn't mean you can't disagree. But disagree without calling the other person names. If you're right, your argument will be more convin…

I would say it to his face.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#444

Post by zxcvb »

betterth wrote: post #359
zxcvb wrote: post #296

Earlier quoted context omitted.

My point still stands. There's funny and then theres blatent fanboyism. You're like a prepubescent teenager who doesn't understand the context of social situations so always says something stupid.

Pot, meet kettle.

Being a hypocrite doesn't make me wrong.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#445

Post by zer01 »

andreyf wrote: post #346
rfugger wrote: post #318

Earlier quoted context omitted.

My (very unique) password hash is in the list, although unbroken so far.

Sorry for the stupid question, but where did you guys find the list of hashes? I didn't see it linked in the article. Edit: found it in the Slashdot comments, it's: http://www.mediafire.com/?n307hutksjstow3 For the record, my password's hash was not in the list.

I think they're getting removed. I posted a link from the original source, but it's since disappeared.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#446

Post by masterzora »

eidorianu wrote: post #384
riffraff wrote: post #232

Earlier quoted context omitted.

fwiw, this could also be an elaborate hoax, given this facts. E.g. a list of simple password + combinations of the above simple password+"linkedin" variations.

I agree, I've tried several passwords and they match. If you're a Math person, please shed some light on the chances that this list covers the full space.

0. There are known cases of peoples' passwords (including my own) not on the list.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#447

Post by yesbabyyes »

madmaze wrote: post #204
jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

I disagree with #5, I had a few of my coworkers check their sha1 against the DB and most of them were not in the dump. I also checked for truncated hashed, none of which were found. I have the feeling this is a subset of the full database

My password is in the dump. I use the Forget Passwords Chrome extension [1], which is based on pwdhash.com, and generate site-specific passwords based on a master password -- i.e. my password is only used on LinkedIn and it's unlikely that I share it with someone else.

I think I have changed to this password during the last year.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#449

Post by scoot »

slavak wrote: post #399
vivekian2 wrote: post #329

Earlier quoted context omitted.

Or you could just feed "sha1 " to the duckduckgo.com search box and it will give the result.

Some people have this thing against sending their private passwords in plaintext to third-party websites...

Well presumably you've already changed your LinkedIn password, so what's not to send?

Re: 6.5 Million LinkedIn Password Hashes Leaked

#450

Post by diminoten »

royce wrote: post #392
jgrahamc wrote: post #170

Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…

A stock JtR 1.7.9-jumbo5, using the default rules, is finding quite a few of the non-zeroed ones pretty quickly. This surprises me; I would have expected them to have run the list through the JtR mill before passing it on to others.

The list of cracked hashes is almost certainly not complete, one can conclude from this fact.
Post reply on HN