Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LeakedIn

leakedin.org

Post reply on HN
Print view View original

81–90 of 194 posts

Re: LeakedIn

#81

Post by hamoid »

jperras wrote: post #36
paulhodge wrote: post #27

Earlier quoted context omitted.

Still, hashes can be cracked, and an evil password-checking website can then associate the password with all of the other personally-identifiable data that browsers are known to leak. I don't think this particular site is being evil, but it would be wrong for a user to trust a site like this.

Again, you can check the source. It's a single page for a reason ;-). There's no trickery hidden in there.

Maybe no trickery hidden in there now, but that could change any time. Or sometimes. Or depending on IP, browser or OS.

Re: LeakedIn

#82

Post by olemartinorg »

towts wrote: post #70
olemartinorg wrote: post #48

Oh.. Didn't know anyone already made this - i also made a tool, but it doesn't send your whole hash over the wire (only the last 4 chars). http://olemartin.org/linkedin-passwords/

i observed it seems this tool and the leaked in one don't agree on the resulting hash value from the same word. for example this tool says the word "test" hashes with the last 5 digits of 77136 where as leaked in translates the word "test" to fbbd3. hmmm

Thanks! I've changed it now. Seems i didn't catch the key event properly. :-)

Re: LeakedIn

#83

Post by jperras »

paulhodge wrote: post #51
jperras wrote: post #36

Earlier quoted context omitted.

Again, you can check the source. It's a single page for a reason ;-). There's no trickery hidden in there.

I mean server-side (can we check the source for that?). The server could crack the hash, and the server could use various pieces of data (ip address, http headers, etc) to try to figure out more about the password's owner.

True, that's completely possible. However, if this concerns you then you should probably not sign up for any account on any site, since they could be doing the very same thing with your actual password.

Re: LeakedIn

#84

Post by olemartinorg »

Terretta wrote: post #68
olemartinorg wrote: post #48

Oh.. Didn't know anyone already made this - i also made a tool, but it doesn't send your whole hash over the wire (only the last 4 chars). http://olemartin.org/linkedin-passwords/

Nice looking page for such fast work. What about letting 'advanced' users check the SHA1 of their password, so they don't enter their password at all but also don't have to track down the giant file?

That should work already - just use the other field and click the button. :-) There's no giant file though, i've split the giant file into ~65000 smaller ones that are more bandwidth friendly.

Re: LeakedIn

#85

Post by jperras »

its_so_on wrote: post #56

Sorry, I don't mean to be harsh, but this concept is pretty much dead on arrival. "Check if your hash is still private and secure by sending us your hash." Well, even if the hash was secure, it isn't now! (Unless you: O get the whole database into the client O ask the user to: o reload the URL in PRIVATE browsing mode o DISCONNECT from the network o test the results with javascript o close the whole browser o reopen…

You should consider the password and hash that you test as already compromised and in the wild, thus making this app just a simple convenience for you and other linkedin users.

Re: LeakedIn

#87

Post by deno »

obituary_latte wrote: post #55
hung wrote: post #26

I quickly wrote a script to do this locally, not the most efficient, but I'm at work ;) https://github.com/hungtruong/LinkedIn-Password-Checker

Thank you. Worked for me as well... I wonder what kind of bonkers executive at LI decided it would not be a good idea to do a sweeping wipe of all passwords on their systems... for user in users: force_pw_reset(user); def force_pw_reset(user): user.pw = rand; user.sendResetEmail(); (note to LI: this isn't real code; don't use)

Now just send phising emails with fake reset links to your targets at the same time. Password reset should be enforced at first login.

Re: LeakedIn

#88

Post by [deleted] »

hung wrote: post #26

I quickly wrote a script to do this locally, not the most efficient, but I'm at work ;) https://github.com/hungtruong/LinkedIn-Password-Checker

[deleted]

Re: LeakedIn

#90

Post by raverbashing »

jerf wrote: post #63
pbreit wrote: post #8

Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.

http://www.inutile.ens.fr/estatis/password-security-checker/ (BTW, be sure to type some gibberish into the provided box and hit submit, so you can see why I think this is a very relevant link.)

Bonus points for those who submit, read what it presented then proceeded to test another password!
Post reply on HN