111–120 of 218 posts
Do we know how strong their hashing scheme was? Edit: SHA-1... You'd think a site as big as linkedin would have strong hashing...
They didn't move fast enough to get accounts moved over.
Earlier quoted context omitted.
Ah...I assumed that a leak happening via third-party would be an excuse for a company to be legit confused at first and then breathe a sigh of relief because that means they can blame someone else in the press release. Though I guess that's tricky when people start asking about why their data is being given in bulk to a third party in the first place...
Doesn't matter. If your logo is on the product, it's your fault. Full stop.
Earlier quoted context omitted.
password managers
Tinfoil hat time: if your password manager uses a bad generation scheme or backdoored RNG like Dual EC, then its passwords might be much easier to crack than they would appear. https://en.wikipedia.org/wiki/Dual_EC_DRBG
I wonder if that's actually a risk? At least for people not being individually targeted?
A random Elbonian hacker who gets a dump of 117 million password hashes has (at least) three approaches she can take to make use of it - she can run oclHashcat or JtR using a good wordlist (say, Hashkiller or phpbb) and a reasonable ruleset to tweak them, which'll fairly quickly reveal common, reused, or guessable passwords in hours/days/weeks - or she can set it to enumerate through an entire $howeverymany bit password space, which is guaranteed to find all the passwords but not before the heat death of the universe... Or she could try only the selections out of that random keyspace that a flawed version of FooPasswordSafe is capable of generating. I'm not sure how long the last approach would take, but it'd have to be both a pretty flawed PRNG and a very widely used password safe for it to come anywhere near as useful as approach 1.
(If she's only cracking the hash for the sbeirwagen@gmail.com record, things are somewhat different to if she's just trying to find _any_ "useable" passwords out of 117 million... And if she _knows_ sbeirwagen uses DudPasswordSafe.exe, it's likely she knows better ways of attempting to acquire your password than hoping to crack it from publicly released credential dumps...)
That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one.
If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously.
Don't use the same password on multiple sites. If your LinkedIn password is leaked, you don't want that same password to grant access to your bank account. That just as important than how strong the password is, if not more.
If some site has suffered a password leak, and you're a user of that site, you must change the password on that site, and also on all other sites where you happened to use the same password. Do it as quickly as possible without worrying how strong the new passwords are. Then change later to stronger ones.
A password's strength is inversely proportional to how often you change it. For instance, if you happen to change a password every week (for the sake of argument---few people likely do), and it takes a month to crack on the best available hardware cluster, then you're probably okay. If you change only once a year, you're much less okay; a surreptitious password breach could happen, and two months of cracking later, the attackers have your password. Meanwhile, you're still months away from changing it, not knowing there had been a breach.
By the time users learn about a breach---if ever---they should assume that their passwords have been cracked, because some unknown amount of time has passed between the actual break and the discovery. The discovery will likely stem from the fact that some of the "lower hanging" passwords have been cracked and accounts start being misused. The site admins can then only guess from various circumstantial information (logs or whatever other breadcrumbs left bind) about when the leak might have occurred.
Yes, I know - don't reuse and use a password manager. But not everyone follows best practice. Knowing which password motifs to absolutely not reuse would be helpful.
Earlier quoted context omitted.
I know of a company that experienced a data breach (one that was reported in the news) due to an employee using the same password on linkedin as on their company account.
Was linkedin verified to be the source of the password or is this just speculation?
Logic tells me I've got nothing to worry about, even considering potential password reuse, if they've all changed since then.
Also, why is the 2FA option hidden under "Privacy" and not right next to the Change Password option? You'd think they would want to advertise 2FA better...
Why do people insist on using sms as the second factor? Let me use TOTP (e.g. Google Authenticator). I don't get reception everywhere!
Question for the more security-savvy among you: If the leak happened in 2012 and I've changed my password since then (it's listed in your account page [1]), do I need to change it again? Logic tells me I've got nothing to worry about, even considering potential password reuse, if they've all changed since then. [1] https://www.linkedin.com/psettings/account
Aaaand that's why I use 'pwgen -s 22' to generate a unique password for every single site I use. I don't care if a salted password database is stolen; heck, as soon as I change my password I don't even care if a plaintext database is stolen. Why -s? Because it means each password is a complete word, and may easily be double-clicked in a password list (which is nice, because selection is copy in X). Why 22 characters?…
Good for you. Too bad most people can't even be bothered to use more than a couple variations of the same password. This is an area that will get much more attention in coming years as technology finds better ways to authenticate us instead of using secret codes we have to remember.
I've used some sites which had a login cookie, and if you lost it, you just put your email address in and they'd send you a new link, no password needed; much nicer for many things.