Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6.5 Million LinkedIn Password Hashes Leaked

translate.google.com

Post reply on HN
Print view View original

461–470 of 547 posts

Re: 6.5 Million LinkedIn Password Hashes Leaked

#461

Post by mrb »

veemjeem wrote: post #111
16s wrote: post #71

Earlier quoted context omitted.

With these sorts of simple hashes, you don't need rainbow tables when you have a few GPUs and OCLHashcat.

It would still take a moderate amount of time for a single password if it's long and complex -- you're essentially generating the rainbow table. You might as well just download a sha1 rainbow table and just perform a O(1) lookup. You could reverse all the 6.5M password hashes in mere seconds.

Actually, for a large enough list of unsalted password hashes, bruteforcing is faster that rainbow tables:

- a rainbow table may require a constant amount of time to reverse 1 hash, but it has to be repeated N times for N passwords.

- when bruteforcing, a password candidate can be checked against N hashes in a constant amount of time (look up the candidate hash in a hash table)

For example if it takes 10 minutes to look up a hash in a very large rainbow table (such as the A5/1 GSM tables published a few years ago), it would take 123 years to attempt to reverse these 6.5M hashes. On the other hand, millions of the leaked SHA1 hashes can be cracked in mere hours on a GPU with oclhashcat which tests billions of candidate hashes per second.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#463

Post by pjscott »

moondowner wrote: post #51

You can generate your own SHA1 for your password and check if it's existing in the txt file. http://jssha.sourceforge.net/

Or, if you don't trust random web sites, we can turn this into the next fizzbuzz:

    $ python -c 'import hashlib; print hashlib.sha1("hunter2").hexdigest()'
This will print the SHA1 hash of "hunter2".

Re: 6.5 Million LinkedIn Password Hashes Leaked

#464

Post by [deleted] »

jgrahamc wrote: post #224
peterwwillis wrote: post #213

Earlier quoted context omitted.

Obligatory perl one-liner: perl -MDigest::SHA -le '$h = substr( Digest::SHA::sha1_hex($ARGV[0]) , 5 ); open F, " )' password (for people without shells)

Obligatory shell one-liner: grep `echo -n password | shasum | cut -c6-40` hacked.txt

[deleted]

Re: 6.5 Million LinkedIn Password Hashes Leaked

#465

Post by uselessuseof »

jgrahamc wrote: post #224
peterwwillis wrote: post #213

Earlier quoted context omitted.

Obligatory perl one-liner: perl -MDigest::SHA -le '$h = substr( Digest::SHA::sha1_hex($ARGV[0]) , 5 ); open F, " )' password (for people without shells)

Obligatory shell one-liner: grep `echo -n password | shasum | cut -c6-40` hacked.txt

obligatory comments

- not portable

- useless use of backticks

printf password|openssl sha1|cut -c6-40|grep -f - hacked.txt

Re: 6.5 Million LinkedIn Password Hashes Leaked

#466

Post by uselessuseof »

rasengan wrote: post #362
olifante wrote: post #312

Earlier quoted context omitted.

Prefix the whole command with a space to avoid dumping your password into your bash history: " grep `echo -n yourpassword | shasum | cut -c6-40` SHA1.txt"

I couldn't really find a good reason to use a .bash_history. I linked mine to /dev/null and never looked back. (heh)

export HISTSIZE=0

Re: 6.5 Million LinkedIn Password Hashes Leaked

#467

Post by someone_welsh »

drivebyacct2 wrote: post #350
swombat wrote: post #98

Am I glad that I use LastPass and have a different, 12-character password for every service? Why, yes, yes, I am. I've now changed my LinkedIn password, too, just in case.

It saddens me that every, single, time this topic comes up, HackerNews, of all places, displays an immense lack of knowledge of current password storage applications, how they work and what value they bring. I think it's really humorous that people feel safe putting an encrypted file in something like Dropbox, but don't trust LastPass (who are doing the exact same thing, everything is local, client side encryption).…

I apologise for my immense lack of knowledge of current password storage applications (i'm not a programmer and come here for the other stuff), but what is the benefit of these services (lastpass etc)? This is a genuine question.

It seems to me that instead of having several passwords in my head (i can remember random long strings of characters pretty well, and have a heirachy of randomness/longness depending on what I care about), I only have to remember one. But if that one's compromised, aren't all the rest then available?

Reminds me of the bit in hitchhikers guide to the galaxy (life the universe and everything i think) where passwords and biometrics etc had become really difficult and secure, so a datacube thing was created to store them all. Which was then found by a character before hilarity ensued.

thanks

Re: 6.5 Million LinkedIn Password Hashes Leaked

#468

Post by [deleted] »

drivebyacct2 wrote: post #350
swombat wrote: post #98

Am I glad that I use LastPass and have a different, 12-character password for every service? Why, yes, yes, I am. I've now changed my LinkedIn password, too, just in case.

It saddens me that every, single, time this topic comes up, HackerNews, of all places, displays an immense lack of knowledge of current password storage applications, how they work and what value they bring. I think it's really humorous that people feel safe putting an encrypted file in something like Dropbox, but don't trust LastPass (who are doing the exact same thing, everything is local, client side encryption).…

[deleted]

Re: 6.5 Million LinkedIn Password Hashes Leaked

#469

Post by uselessuseof »

akkartik wrote: post #324
shill wrote: post #276

Earlier quoted context omitted.

I have found one case where both types are present. grep `echo -n l1nked0ut | shasum | cut -c6-40` combo_not.txt 000000afef5f2ba94b104126d04db1837f423816 e7bf10afef5f2ba94b104126d04db1837f423816

How many hashes are present in both stripped and unstripped form? $ cat combo_not.txt |cut -c7-40 |sort |dups |wc -l 670781 That's ~10% of the total.

another useless use of cat

cut -c7-40 combo_not.txt|sort|dups|wc -l

what the heck is dups?

cut -c7-40 combo_not.txt|sort|uniq -d|wc -l

Re: 6.5 Million LinkedIn Password Hashes Leaked

#470

Post by uselessuseof »

dpritchett wrote: post #404
ionwake wrote: post #388

Earlier quoted context omitted.

Hi - what does " xargs node -e " do? Thank you

[node -e] evaluates a line of node.js source from a command line argument: $ node -e "console.log('Hello, world.')" Hello, world. [xargs] allows you to pipe the output of one command as an argument to another command. By default it will show up at the tail end of the second command's arg list, but if you want to interleave it you can use -I flag: $ echo /usr/share/dict/words | xargs head -5 A A's AOL AOL's $ echo pet…

head -5 /usr/share/dict/words

same result as with xargs

grep petard /usr/share/dict/words

same result as with xargs

not sure what you are trying to demonstrate here

useless use of xargs?

Post reply on HN