[deleted]
LeakedIn
91–100 of 194 posts
Re: LeakedIn
#92Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
You can supply just your password hash if you want, and if you supply the raw password, it's hashed client-side via Javascript before being sent to the server. Test it out with firebug and a dummy password if you're not keen on wading through the source.
What would be good is to have the 'checking request' return a json (or just a short info) and not a whole html
Re: LeakedIn
#93I made something almost the same (including name!), except all check is done in browser: http://crackedin.s3-website-us-east-1.amazonaws.com/ And it's hosted on S3 so it is faster :)
I just wanted the list in an easily downloadable format so I can check offline (easily downloadable == not the rapidshare of russia, something you could wget) But I submitted the hash of my password and it's there so...
[deleted]
Re: LeakedIn
#94I made something almost the same (including name!), except all check is done in browser: http://crackedin.s3-website-us-east-1.amazonaws.com/ And it's hosted on S3 so it is faster :)
I just wanted the list in an easily downloadable format so I can check offline (easily downloadable == not the rapidshare of russia, something you could wget) But I submitted the hash of my password and it's there so...
I have a torrent up of the database so you can check locally,
here: http://www.seedpeer.me/download/linkedin_hashes/ad1e93a1aee2...
Re: LeakedIn
#95Earlier quoted context omitted.
Thank you. Worked for me as well... I wonder what kind of bonkers executive at LI decided it would not be a good idea to do a sweeping wipe of all passwords on their systems... for user in users: force_pw_reset(user); def force_pw_reset(user): user.pw = rand; user.sendResetEmail(); (note to LI: this isn't real code; don't use)
Now just send phising emails with fake reset links to your targets at the same time. Password reset should be enforced at first login.
Ah yes, didn't consider that...you are correct--reset should be forced on login.
Though I doubt any of the above will happen. Wouldn't want the user to be inconvenienced now would we?
Re: LeakedIn
#96I wish I could down vote or delete this article. Regardless of the creator's intentions, there are a lot of non-techie people on HN (like one of my co-workers) who used this site to check their linkedin password. It reinforces fatal security habits.
Re: LeakedIn
#97We need a "wasmylinkedinpasswordleaked.com" with yes as the content.
haha, quite funny. I made it.
Re: LeakedIn
#98I'm really enjoying testing completely silly passwords against the leaks.
'pooppants' is a confirmed hit. "World's Largest Professional Network". I like to imagine some suit with a cigar logging into look for new hires with that one.
Re: LeakedIn
#99My password was leaked and cracked. It is also the same password I use on Hacker News. :((((
Re: LeakedIn
#100Earlier quoted context omitted.
Interesting implementation, but won't this eat up a lot of bandwidth and cause a high S3 bill?
I cut the hash database into 256 pieces based on the last two digits of hash so chunk is smaller than 1MB. To check one password it only downloads one piece. So hopefully it won't be that bad.
Assuming the split is computer-generated based on a parameter, why not use the last three digits and cut it into 4096 pieces, where each chunk is under 64KB? If your bandwidth bill is small it won't matter (ie: not worth the time involved) but if you get a bunch of traffic your cost is 1/16th of what it would have been. Also, to the user the site will be way more responsive as the download will happen quicker.