I was compromised :(
LeakedIn
171–180 of 194 posts
Re: LeakedIn
#172Earlier quoted context omitted.
$ cat combo_not.txt | grep `printf linkedintrouble | sha1sum` 3ac85868a20c977661a12f770f0d116f87c74831 $ cat combo_not.txt | grep `printf nathanlinkedin | sha1sum` a4d28368130ad555c77ec6a4dd18b8977ac0f589 $ cat combo_not.txt | grep `printf mypassword | sha1sum` $ cat combo_not.txt | grep `printf yourpassword | sha1sum` $
printf linkedintrouble |openssl sha1|grep -f - combo_not.txt
This doesn't work, because:
$ printf linkedintrouble | openssl sha1
(stdin)= 3ac85868a20c977661a12f770f0d116f87c74831
Yes, I've read http://partmaps.org/era/unix/award.html#cat . The output of sha1sum already contains a trailing '-' which is something I wanted to feed into 'grep' using command substitution, so that 'grep' can now just accept the input stream from 'stdin'. Now, how do you feed the input to grep via 'stdin' if you don't want to use 'cat'?
Re: LeakedIn
#173Earlier quoted context omitted.
$ cat combo_not.txt | grep `printf linkedintrouble | sha1sum` 3ac85868a20c977661a12f770f0d116f87c74831 $ cat combo_not.txt | grep `printf nathanlinkedin | sha1sum` a4d28368130ad555c77ec6a4dd18b8977ac0f589 $ cat combo_not.txt | grep `printf mypassword | sha1sum` $ cat combo_not.txt | grep `printf yourpassword | sha1sum` $
printf linkedintrouble |openssl sha1|grep -f - combo_not.txt
[deleted]
Re: LeakedIn
#174Earlier quoted context omitted.
LinkedIn said: > users who have already changed their passwords or created a new account won’t have to worry, as they have recently begun hashing and salting their current password databases. http://techcrunch.com/2012/06/06/linkedin-speaks-some-of-tho...
"recently"?!?
Yes, it could have been a little earlier but from what it seems, it was before the leak.
Re: LeakedIn
#175Ahh interesting. My password was on the list(I changed it before checking).
old password: ve78d9k6k
4c1433ca9d58d7d7ba00658d209583d8edde144a
Re: LeakedIn
#176Sorry, I don't mean to be harsh, but this concept is pretty much dead on arrival. "Check if your hash is still private and secure by sending us your hash." Well, even if the hash was secure, it isn't now! (Unless you: O get the whole database into the client O ask the user to: o reload the URL in PRIVATE browsing mode o DISCONNECT from the network o test the results with javascript o close the whole browser o reopen…
You should consider the password and hash that you test as already compromised and in the wild, thus making this app just a simple convenience for you and other linkedin users.
But... a convenience to do what?
Re: LeakedIn
#177lol
Re: LeakedIn
#178Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
http://www.inutile.ens.fr/estatis/password-security-checker/ (BTW, be sure to type some gibberish into the provided box and hit submit, so you can see why I think this is a very relevant link.)
They have a bug. Type a " character and it gets encoded with a backslash in the output.
Re: LeakedIn
#179Earlier quoted context omitted.
printf linkedintrouble |openssl sha1|grep -f - combo_not.txt
This doesn't work, because: $ printf linkedintrouble | openssl sha1 (stdin)= 3ac85868a20c977661a12f770f0d116f87c74831 The leading '(stdin)=' messes the pattern being fed to 'grep'. Yes, I've read http://partmaps.org/era/unix/award.html#cat . The output of sha1sum already contains a trailing '-' which is something I wanted to feed into 'grep' using command substitution, so that 'grep' can now just accept the input str…
BTW, the commands involving 'openssl' can be fixed in this manner.
$ printf linkedintrouble | openssl sha1 | cut -c10- | grep -f - combo_not.txt
3ac85868a20c977661a12f770f0d116f87c74831