131–140 of 194 posts
password
asdfasdf (whew!)
linkedinpassword
password1
password$
linkedin
a1a1a1a1
drowssap
12345678Earlier quoted context omitted.
Now just send phising emails with fake reset links to your targets at the same time. Password reset should be enforced at first login.
Ah yes, didn't consider that...you are correct--reset should be forced on login. Though I doubt any of the above will happen. Wouldn't want the user to be inconvenienced now would we?
A large forum I post on was hacked recently and - after voluntarily shutting their site down for a month - they required password resets. If users did not have access to the email address they signed up with and couldn't otherwise verify their identity, they were not allowed to get their account back.
Unsurprisingly, post counts are down site-wide and the owners have reported a > 25% decrease in traffic.
Earlier quoted context omitted.
I mean server-side (can we check the source for that?). The server could crack the hash, and the server could use various pieces of data (ip address, http headers, etc) to try to figure out more about the password's owner.
True, that's completely possible. However, if this concerns you then you should probably not sign up for any account on any site, since they could be doing the very same thing with your actual password.
Good news, the following passwords where not leaked: password asdfasdf (whew!) linkedinpassword The following were: password1 password$ linkedin a1a1a1a1 drowssap 12345678
I quickly wrote a script to do this locally, not the most efficient, but I'm at work ;) https://github.com/hungtruong/LinkedIn-Password-Checker
$ cat combo_not.txt | grep `printf linkedintrouble | sha1sum` 3ac85868a20c977661a12f770f0d116f87c74831 $ cat combo_not.txt | grep `printf nathanlinkedin | sha1sum` a4d28368130ad555c77ec6a4dd18b8977ac0f589 $ cat combo_not.txt | grep `printf mypassword | sha1sum` $ cat combo_not.txt | grep `printf yourpassword | sha1sum` $
Earlier quoted context omitted.
Even if you don't check the source code to verify that it's harmless, you should assume your password has been compromised and have already changed it anyway. This just lowers the cost of checking the list and could help us learn more about the compromise.
If the hole that let them in hasn't been closed yet, changing the password will make that password vulnerable, right?
> users who have already changed their passwords or created a new account won’t have to worry, as they have recently begun hashing and salting their current password databases.
http://techcrunch.com/2012/06/06/linkedin-speaks-some-of-tho...
thanks
Earlier quoted context omitted.
Or call shasum or sha1sum and input your password on stdin so your shell history doesn't contain your password in plain text.
how do you get rid of the carriage return as last char that way?