Earlier quoted context omitted.
Hate to say it, but someone executed on this before you: http://ismycreditcardstolen.com/
I'm not worried, mine is "Social"
Cool, does it use Web 2.0 and have an API?
LeakedIn
111–120 of 194 posts
Re: LeakedIn
#112Even if this is a completely trusted and secure site, why would you not use SSL for something like this?
Transport layer security is a serious issue, especially for people prone to password reuse.
Re: LeakedIn
#113Earlier quoted context omitted.
You're confusing "not on the list" with "not in the hacker's possession".
Don't all the hashes listed have "c3dxxxxx" at the end. They to me, at a glance, look like a partial. Head: 00000fac2ec84586f9f5221a05c0e9acc3d2e670 0000022c7caab3ac515777b611af73afc3d2ee50 deb46f052152cfed79e3b96f51e52b82c3d2ee8e 00000dc7cc04ea056cc8162a4cbd65aec3d2f0eb 00000a2c4f4b579fc778e4910518a48ec3d2f111 b3344eaec4585720ca23b338e58449e4c3d2f628 674db9e37ace89b77401fa2bfe456144c3d2f708 Tail: 00000e585039977da2b…
No, just a bunch at the top and at the bottom.
Just 1570 out of the 6 million. (I did:
grep 'c3d.....$' SHA1.txt |wc -l)
It's not clear to me how the file was sorted. Anyone have any ideas?
Re: LeakedIn
#114Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
I saw a spam once that said "Is your husband's password compromised? Check it on this site ..." clearly trying to social engineer a spouse into 'doing a favor.'
These people can be very very very evil.
Re: LeakedIn
#115The link appears to be down now, either it served its nefarious purpose or it's a victim of its own success.
Re: LeakedIn
#116I made something almost the same (including name!), except all check is done in browser: http://crackedin.s3-website-us-east-1.amazonaws.com/ And it's hosted on S3 so it is faster :)
I just wanted the list in an easily downloadable format so I can check offline (easily downloadable == not the rapidshare of russia, something you could wget) But I submitted the hash of my password and it's there so...
www.mediafire.com/?n307hutksjstow3
Click download, copy the URL from your browser into wget/axel/download manager. I get a solid 1mb/s from media fire.
Re: LeakedIn
#117Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
Even if you don't check the source code to verify that it's harmless, you should assume your password has been compromised and have already changed it anyway. This just lowers the cost of checking the list and could help us learn more about the compromise.
If the hole that let them in hasn't been closed yet, changing the password will make that password vulnerable, right?
Re: LeakedIn
#118If your hash is not on that list, it's bad news. There are indications that the hacker published only the hashes he needed help with. The others were more easily decoded.
Re: LeakedIn
#119Earlier quoted context omitted.
Just pop a space at the beginning and it won't go into shell history.
It does for me > echo test test > history ... 6730 echo test 6731 history
Set this in your .bashrc
HISTCONTROL=ignorespace
HISTCONTROL=ignoredups:ignorespaceRe: LeakedIn
#120Earlier quoted context omitted.
Or call shasum or sha1sum and input your password on stdin so your shell history doesn't contain your password in plain text.
Just pop a space at the beginning and it won't go into shell history.
That's a bash-ism that's controlled by the $HISTCONTROL environment variable, not universally-applicable advice. $HISTCONTROL set to "ignorespace" or "ignoreboth" may or may not be the default, depending on your distribution.