The worst is I can't remember what password I used but don't want to change it because I want to know if it's one I used somewhere else not just reset it.
6.5 Million LinkedIn Password Hashes Leaked
471–480 of 547 posts
Re: 6.5 Million LinkedIn Password Hashes Leaked
#472Earlier quoted context omitted.
It saddens me that every, single, time this topic comes up, HackerNews, of all places, displays an immense lack of knowledge of current password storage applications, how they work and what value they bring. I think it's really humorous that people feel safe putting an encrypted file in something like Dropbox, but don't trust LastPass (who are doing the exact same thing, everything is local, client side encryption).…
I apologise for my immense lack of knowledge of current password storage applications (i'm not a programmer and come here for the other stuff), but what is the benefit of these services (lastpass etc)? This is a genuine question. It seems to me that instead of having several passwords in my head (i can remember random long strings of characters pretty well, and have a heirachy of randomness/longness depending on what…
If someone has access to:
1. Your physical machine, or the LastPass/Dropbox server.
2. Your master password
3. (optionally) a second-factor auth source
Then yes, they have access to all your passwords. But this is vastly superior to having one password that alone compromised grants access to all of your accounts, right?
I mean, the most secure way imaginable would be perfect biometric signatures, or humans smart enough that they could perform asymmetric encryption in their heads to sign challenges in a verifiable manner. Outside of that, this is decentish.
You could use a text file in a Truecrypt volume with keys that are stored on separate jumpdrives (but what if someone compromises a machine that you plug those drives into), etc, etc.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#473I'm starting to think it might be wise, if you intend to reuse your password on multiple sites, to salt it yourself. By using a form like " And yes, yes, I know you shouldn't be reusing your password across different sites, or using a dictionary word anyway. And teenagers also shouldn't be drinking, doing drugs and having sex. It doesn't help anything to pretend that people are going to behave optimally. Of course, t…
I've been doing this myself and it has worked out pretty well so far. My password is in the list of passwords released, but is uncracked and I can rest assured knowing that I did not use the same password on any other website.
A couple things to keep in mind:
1) The salt you generate should be put at the front in case the website is silently truncating the password to a certain length
2) The salt can be something more complicated than site name. I mentally calculate a fixed length salt based on the site name
3) You may want to still keep two separate "base" passwords, one for high value sites (banks, email) and one for low value sites (everything else).
Re: 6.5 Million LinkedIn Password Hashes Leaked
#474John the Ripper released a patch for this modified sha1 hash type today. So no need for any manual hacks. You may download the patch here:
Re: 6.5 Million LinkedIn Password Hashes Leaked
#475Earlier quoted context omitted.
How many hashes are present in both stripped and unstripped form? $ cat combo_not.txt |cut -c7-40 |sort |dups |wc -l 670781 That's ~10% of the total.
another useless use of cat cut -c7-40 combo_not.txt|sort|dups|wc -l what the heck is dups? cut -c7-40 combo_not.txt|sort|uniq -d|wc -l
Yeah I'm aware of http://partmaps.org/era/unix/award.html#cat and choose to continue writing my scripts this way. My commands look more symmetric at the prompt, and are easier to manipulate.
dups is indeed a little helper of mine. Like uniq it only handles sorted input. Update: I see you edited your answer to include uniq -d. I wasn't aware of the option, thanks. Now I can simplify the implementation of dups. But I find the name valuable, and I think it's perverse to say uniq when you mean its opposite.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#476I just made an online too to check if your password is in the list: http://billsnitzer.com/linkedin/
Re: 6.5 Million LinkedIn Password Hashes Leaked
#477Is it scary to anyone else that LinkedIn can't confirm yet if their security was compromised?
Re: 6.5 Million LinkedIn Password Hashes Leaked
#478Earlier quoted context omitted.
another useless use of cat cut -c7-40 combo_not.txt|sort|dups|wc -l what the heck is dups? cut -c7-40 combo_not.txt|sort|uniq -d|wc -l
Yeah I'm aware of http://partmaps.org/era/unix/award.html#cat and choose to continue writing my scripts this way. My commands look more symmetric at the prompt, and are easier to manipulate. dups is indeed a little helper of mine. Like uniq it only handles sorted input. Update : I see you edited your answer to include uniq -d . I wasn't aware of the option, thanks. Now I can simplify the implementation of dups . But…
symmetric?
Re: 6.5 Million LinkedIn Password Hashes Leaked
#479Earlier quoted context omitted.
Yeah I'm aware of http://partmaps.org/era/unix/award.html#cat and choose to continue writing my scripts this way. My commands look more symmetric at the prompt, and are easier to manipulate. dups is indeed a little helper of mine. Like uniq it only handles sorted input. Update : I see you edited your answer to include uniq -d . I wasn't aware of the option, thanks. Now I can simplify the implementation of dups . But…
symmetric?
Each pipe stage reads from the left and writes to the right. The eye goes left to see the input and right to see the output if it's redirected to file.
The input file is reliably the second word, so C-A M-f gets me to it if I want to operate on a different file. !!:1 gets me the file if I want to use it in a new command.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#480Earlier quoted context omitted.
How much slower would you estimate it being?
1MB of data will have 16384 SHA 256 blocks. So that's roughly the slowdown I would expect, minus the time it takes to initialize the algorithm for a particular message. That's not that interesting by itself, but it is interesting to think about how this would affect computing the hashes on GPUs.
And how high can you crank the work factor for, say, bcrypt?