Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6.5 Million LinkedIn Password Hashes Leaked

translate.google.com

Post reply on HN
Print view View original

491–500 of 547 posts

Re: 6.5 Million LinkedIn Password Hashes Leaked

#491

Post by akkartik »

uselessuseof wrote: post #490
akkartik wrote: post #479

Earlier quoted context omitted.

Each pipe stage reads from the left and writes to the right. The eye goes left to see the input and right to see the output if it's redirected to file. The input file is reliably the second word, so C-A M-f gets me to it if I want to operate on a different file. !!:1 gets me the file if I want to use it in a new command.

echo abc > file 1. cat file 2. cat 3. echo abc|cat 4. echo abc|cat - file cat can take input from the left, the right, or both same goes for cut

I'm not sure what you're suggesting. I'm supposed to echo |cut ...? But I have a whole file, not just one line. So I have to cat ... |cut ... -- which is what I did. So what's your point?

I could keep the file first by saying:

  $
To which I reply, "Yuck!"

Perhaps we should stop here. You seem to have made this account just a few hours ago for the express purpose of poking at people's code fragments in this thread. You're making stylistic nitpicks (they don't affect correctness, do they?) and you're making them in a tone that I'm not sure I would take from Randal Schwartz himself (you actually edited http://news.ycombinator.com/item?id=4076556 to be ruder than the original). It's a drag, man.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#492

Post by daeken »

dredmorbius wrote: post #421
slavak wrote: post #399

Earlier quoted context omitted.

Some people have this thing against sending their private passwords in plaintext to third-party websites...

You're sending the hash, not the password. DDG supports SSL: https://www.duckduckgo.com/ If you want coverage, generate a few hundred thousand SHA1 hashes along with your password. Actually, running a trickle query of random SHA1 hashes from your box might be a fun exercise, along with a trickle query of random word tuples (bonus points for using Markov chains to generate statistically probable tuples).

If you search for 'sha1 foo', that's being sent across the network to DDG's servers. And sure, if you're using SSL then it's not going across in plain text, but it's decrypted and handled on their servers in plain text; it'll probably even end up in logs and/or tracking databases somewhere. You're giving DDG your password.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#493

Post by nohat »

Smerity wrote: post #115

"We were curious what would happen to our share price if our company did something incredibly stupid" The above comment might seem incredibly harsh, but really, there's no good excuse for a site this prominent to not have a salted, secure password hashing system. Even if they started with an unsalted password system, users can be migrated to the newer more secure system on next login. The only way I could regain resp…

Perhaps the worst part is that they either didn't know about the breach (likely), or didn't tell anyone (hopefully not).

Re: 6.5 Million LinkedIn Password Hashes Leaked

#494

Post by [deleted] »

Smerity wrote: post #115

"We were curious what would happen to our share price if our company did something incredibly stupid" The above comment might seem incredibly harsh, but really, there's no good excuse for a site this prominent to not have a salted, secure password hashing system. Even if they started with an unsalted password system, users can be migrated to the newer more secure system on next login. The only way I could regain resp…

[deleted]

Re: 6.5 Million LinkedIn Password Hashes Leaked

#495

Post by [deleted] »

Smerity wrote: post #115

"We were curious what would happen to our share price if our company did something incredibly stupid" The above comment might seem incredibly harsh, but really, there's no good excuse for a site this prominent to not have a salted, secure password hashing system. Even if they started with an unsalted password system, users can be migrated to the newer more secure system on next login. The only way I could regain resp…

[deleted]

Re: 6.5 Million LinkedIn Password Hashes Leaked

#496

Post by catch23 »

mrb wrote: post #461
veemjeem wrote: post #111

Earlier quoted context omitted.

It would still take a moderate amount of time for a single password if it's long and complex -- you're essentially generating the rainbow table. You might as well just download a sha1 rainbow table and just perform a O(1) lookup. You could reverse all the 6.5M password hashes in mere seconds.

Actually, for a large enough list of unsalted password hashes, bruteforcing is faster that rainbow tables: - a rainbow table may require a constant amount of time to reverse 1 hash, but it has to be repeated N times for N passwords. - when bruteforcing, a password candidate can be checked against N hashes in a constant amount of time (look up the candidate hash in a hash table) For example if it takes 10 minutes to l…

true, for extremely large rainbow tables. SHA1 tables are around 20-60GB depending on how large your base character set is. If you shoved all this data into a giant database, query speed is still under a few milliseconds. In general, rainbow tables can be sharded fairly easily, so if your data set is a few hundred terabytes, just split it across a few machines and you'll retain the millisecond query times. Storing and querying easily partitioned data will usually be faster than a brute force calculation.

Calculating it is like saying you want to find the fibonacci number for any given N, and you have a really fast processor to calculate it to that N, but if you just persisted pre-calculated values up to C, you'd only need to calculate N-C hashes. So even if you are bruteforcing the password, it is still faster to have rainbow tables up to a certain length.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#497

Post by uselessuseof »

akkartik wrote: post #491
uselessuseof wrote: post #490

Earlier quoted context omitted.

echo abc > file 1. cat file 2. cat 3. echo abc|cat 4. echo abc|cat - file cat can take input from the left, the right, or both same goes for cut

I'm not sure what you're suggesting. I'm supposed to echo |cut ... ? But I have a whole file, not just one line. So I have to cat ... |cut ... -- which is what I did. So what's your point? I could keep the file first by saying: $ To which I reply, "Yuck!" Perhaps we should stop here. You seem to have made this account just a few hours ago for the express purpose of poking at people's code fragments in this thread. Yo…

cut takes a file as an argument. there's no need to start the line with 
   cut -c4-70 combo_not.txt|...

Re: 6.5 Million LinkedIn Password Hashes Leaked

#498

Post by akkartik »

uselessuseof wrote: post #497
akkartik wrote: post #491

Earlier quoted context omitted.

I'm not sure what you're suggesting. I'm supposed to echo |cut ... ? But I have a whole file, not just one line. So I have to cat ... |cut ... -- which is what I did. So what's your point? I could keep the file first by saying: $ To which I reply, "Yuck!" Perhaps we should stop here. You seem to have made this account just a few hours ago for the express purpose of poking at people's code fragments in this thread. Yo…

cut takes a file as an argument. there's no need to start the line with cut -c4-70 combo_not.txt|...

But that's where this conversation started out. My response the last time around: http://news.ycombinator.com/item?id=4076674

BTW, HN has some formatting support: http://news.ycombinator.com/formatdoc

Re: 6.5 Million LinkedIn Password Hashes Leaked

#499

Post by verself »

pbhjpbhj wrote: post #431
rasengan wrote: post #362

Earlier quoted context omitted.

I couldn't really find a good reason to use a .bash_history. I linked mine to /dev/null and never looked back. (heh)

Ctrl+r history search? I'd tend to maintaining a complete history log so that when I've forgotten the one liner I used to rotate my videos 2 years ago I can easily recall it.

2 years? Just how big is your history file?

I thought 16k entries might be reasonable but that doesn't even last 3 weeks for me. I think there might have been some issue with slow disk seeks so at some point I restricted it to that many.

I guess it probably it would be better to regularly backup the history file to deal with possible some accidental truncations and issues when running multiple shells concurrently, but probably the overall effort to set up such a system would outweight the benefits.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#500

Post by grannyg00se »

How does this benefit someone who is trying to access an account? There are no account names tied to these hashes. So even if you managed to find the clear text of each of these you would still be in a position where you have a list of over 6,000,000 passwords to work through in order to brute force your way in.
Post reply on HN