huh, I have a linked in account that I don't check often and my password was on that list. Luckily it was specific to linkedin. I don't believe this is just a small percentage of users. Oh and I never received an email like the blog states (http://blog.linkedin.com/2012/06/06/linkedin-member-password...)... odd...
LeakedIn
141–150 of 194 posts
Re: LeakedIn
#142I'm amazed someone took the time to develop this without thinking of the potential trust issues involved.
Re: LeakedIn
#143Earlier quoted context omitted.
If you don't particularly trust the included click.js script, you can generate your password's SHA-1 via python fairly easily python -c 'import hashlib; print hashlib.sha1("PaSSw0rd").hexdigest()'
or easier and shorter: printf PaSSw0rd | sha1sum
What if my password contains % characters?
Re: LeakedIn
#144Earlier quoted context omitted.
Again, you can check the source. It's a single page for a reason ;-). There's no trickery hidden in there.
Maybe no trickery hidden in there now, but that could change any time. Or sometimes. Or depending on IP, browser or OS.
And even if there's no "trickery" from the hosting site, they're slurping in javascript from a 3rd party down the bottom (getclicky). That means they (or anybody who compromises them) could grab the cleartext passwords from the form before the inline javascript does it's sha1 hashing…
Re: LeakedIn
#145Earlier quoted context omitted.
If the hole that let them in hasn't been closed yet, changing the password will make that password vulnerable, right?
LinkedIn said: > users who have already changed their passwords or created a new account won’t have to worry, as they have recently begun hashing and salting their current password databases. http://techcrunch.com/2012/06/06/linkedin-speaks-some-of-tho...
"recently"?!?
Re: LeakedIn
#146I quickly wrote a script to do this locally, not the most efficient, but I'm at work ;) https://github.com/hungtruong/LinkedIn-Password-Checker
Thank you. Worked for me as well... I wonder what kind of bonkers executive at LI decided it would not be a good idea to do a sweeping wipe of all passwords on their systems... for user in users: force_pw_reset(user); def force_pw_reset(user): user.pw = rand; user.sendResetEmail(); (note to LI: this isn't real code; don't use)
The problem isn't really your LinkedIn password ... I mean, someone could mess up your profile, send embarrassing messages and so on, but many many people will have used the same password for amazon, apple, paypal and other financial things, or used the same password for an email account which can be used to "recover" the password for one of those things.
Re: LeakedIn
#147Earlier quoted context omitted.
I cut the hash database into 256 pieces based on the last two digits of hash so chunk is smaller than 1MB. To check one password it only downloads one piece. So hopefully it won't be that bad.
Assuming the split is computer-generated based on a parameter, why not use the last three digits and cut it into 4096 pieces, where each chunk is under 64KB? If your bandwidth bill is small it won't matter (ie: not worth the time involved) but if you get a bunch of traffic your cost is 1/16th of what it would have been. Also, to the user the site will be way more responsive as the download will happen quicker.
Bloom filter?
Re: LeakedIn
#148Good news, the following passwords where not leaked: password asdfasdf (whew!) linkedinpassword The following were: password1 password$ linkedin a1a1a1a1 drowssap 12345678
`password` was leaked. See this comment about the format of hashes in the dump: http://news.ycombinator.com/item?id=4073928
Hm, when I first typed those in, it said not leaked, but now it is saying leaked for all of them. Apologies.
Re: LeakedIn
#149My autogenerated password was in the list, and not cracked. I've changed it anyway on linkedin.
Same for me. "Your password was leaked, but it has not (yet) been cracked. Fingers crossed."
Damnit, LinkedIn.
Re: LeakedIn
#150Heck, isn't it supposed to use type="password" in its input element?