LeakedIn • Hacker News Board

Re: LeakedIn

#181

Post by eric_bullington » Thu, Jun 07, 2012, 11:20 AM UTC

sltkr wrote: post #143

ibotty wrote: post #62

Earlier quoted context omitted.

or easier and shorter: printf PaSSw0rd | sha1sum

What if my password contains % characters?

Yeah, note that this doesn't work with all password combinations. I just use the Python version above

  python -c 'import hashlib; print hashlib.sha1("reALpassWORD12%12").hexdigest()'

and then:

  history -d $((HISTCMD-2))

to delete the last entry in the bash history.

Re: LeakedIn

#182

Post by ajslater » Thu, Jun 07, 2012, 11:25 AM UTC

pbreit wrote: post #8

Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.

http://ismycreditcardstolen.com/

Re: LeakedIn

#183

Post by jheriko » Thu, Jun 07, 2012, 12:03 PM UTC

this smacks of a scam...

Re: LeakedIn

#184

Post by 1zq » Thu, Jun 07, 2012, 12:45 PM UTC

Peaker wrote: post #180

sjs wrote: post #139

Earlier quoted context omitted.

Use Ctrl-d to end input without hitting return and you shouldn't get a newline.

bash, at least, only handles Ctrl-d on its own line.

If you're not on a new line, you can type Ctrl-d twice.

Re: LeakedIn

#185

Post by isnotchicago » Thu, Jun 07, 2012, 3:26 PM UTC

bevan wrote: post #97

Splines wrote: post #24

We need a "wasmylinkedinpasswordleaked.com" with yes as the content.

haha, quite funny. I made it.

I don't think a Like button was in the original charter.

Re: LeakedIn

#186

Post by obituary_latte » Thu, Jun 07, 2012, 3:51 PM UTC

nickzoic wrote: post #146

obituary_latte wrote: post #55

Earlier quoted context omitted.

Thank you. Worked for me as well... I wonder what kind of bonkers executive at LI decided it would not be a good idea to do a sweeping wipe of all passwords on their systems... for user in users: force_pw_reset(user); def force_pw_reset(user): user.pw = rand; user.sendResetEmail(); (note to LI: this isn't real code; don't use)

The problem isn't really your LinkedIn password ... I mean, someone could mess up your profile, send embarrassing messages and so on, but many many people will have used the same password for amazon, apple, paypal and other financial things, or used the same password for an email account which can be used to "recover" the password for one of those things.

True, password re-use is a big problem.

Though, think of how much easier it would be to social-engineer a target were you to have full access to their LI account.

Re: LeakedIn

#187

Post by [deleted] » Thu, Jun 07, 2012, 3:51 PM UTC

nickzoic wrote: post #146

obituary_latte wrote: post #55

Earlier quoted context omitted.

Thank you. Worked for me as well... I wonder what kind of bonkers executive at LI decided it would not be a good idea to do a sweeping wipe of all passwords on their systems... for user in users: force_pw_reset(user); def force_pw_reset(user): user.pw = rand; user.sendResetEmail(); (note to LI: this isn't real code; don't use)

The problem isn't really your LinkedIn password ... I mean, someone could mess up your profile, send embarrassing messages and so on, but many many people will have used the same password for amazon, apple, paypal and other financial things, or used the same password for an email account which can be used to "recover" the password for one of those things.

[deleted]

Re: LeakedIn

#188

Post by dhardy » Thu, Jun 07, 2012, 3:55 PM UTC

angusgr wrote: post #160

dhardy wrote: post #155

Earlier quoted context omitted.

Probably a noob question but... How does this account for any salt that may have been used?

LinkedIn didn't use a salt. Hence the easier-than-it-should-have-been password crackfest. (However, could everyone please stop making random websites encouraging people to type in their passwords from third party sites!)

I suspected that was the answer but this blog post http://blog.linkedin.com/2012/06/06/linkedin-member-password... mentions that they are salting the passwords.

Re: LeakedIn

#189

Post by dhardy » Thu, Jun 07, 2012, 3:55 PM UTC

angusgr wrote: post #160

dhardy wrote: post #155

Earlier quoted context omitted.

Probably a noob question but... How does this account for any salt that may have been used?

LinkedIn didn't use a salt. Hence the easier-than-it-should-have-been password crackfest. (However, could everyone please stop making random websites encouraging people to type in their passwords from third party sites!)

I suspected that was the answer but this blog post http://blog.linkedin.com/2012/06/06/linkedin-member-password... mentions that they are salting the passwords.

Re: LeakedIn

#190

Post by samstave » Thu, Jun 07, 2012, 6:06 PM UTC

madsr wrote: post #110

samstave wrote: post #38

Earlier quoted context omitted.

hunter2

correct horse battery staple.

Years ago, 1996, we had a border router that we inherited and didnt have the password to, nor any way to get it. It was in production and we needed to get the password without killing the config.

David Sifry (founder of linuxcare) was my consultant on the issue - he was able to recover the password after some effort. I'll never forget what it was: Feet4monkey

Your post reminded me of that.