Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn password leak

usblog.kaspersky.com

Post reply on HN
Print view View original

151–160 of 218 posts

Re: LinkedIn password leak

#151

Post by 13of40 »

jasonkostempski wrote: post #135
13of40 wrote: post #132

Earlier quoted context omitted.

Accounts aren't all created equal. Some of my accounts, such as my domain account at work and my online banking account have real power to screw me over. Some are in the middle, like my LinkedIn account, or my gmail account, since they could be used for social engineering. Some are trivial like my Fark account or my Hacker News account. In that last tier, there's no way it's worth my time to keep rotating those on a…

"Some are in the middle, like my LinkedIn account, or my gmail account" Your email account is the golden key to all other accounts that send "forgot password" links to it.

Which is why I protect it. But not as hard as my bank account and not as soft as my fark account. Hence, "middle".

Re: LinkedIn password leak

#152

Post by metafunctor »

jimktrains2 wrote: post #106
jasonpeacock wrote: post #52

Also, why is the 2FA option hidden under "Privacy" and not right next to the Change Password option? You'd think they would want to advertise 2FA better...

Why do people insist on using sms as the second factor? Let me use TOTP (e.g. Google Authenticator). I don't get reception everywhere!

Not only that, but in general, I don't want to give them my phone number. They'll just leak it or abuse it.

Google Authenticator is great, and I use it anywhere I can. I also take a physical backup of the seeds in a secure (and secret) location, in case I lose my device.

Re: LinkedIn password leak

#153

Post by aianus »

bigiain wrote: post #118
jimktrains2 wrote: post #106

Earlier quoted context omitted.

Why do people insist on using sms as the second factor? Let me use TOTP (e.g. Google Authenticator). I don't get reception everywhere!

I get you - but how many places do you not get sms reception but you still have enough internet connection to be trying to log in to LinkedIn? (Inside a data center, maybe?)

> I get you - but how many places do you not get sms reception but you still have enough internet connection to be trying to log in to LinkedIn?

Any time you travel internationally? My phone only has one SIM slot and it's not going to be the $10/MB roaming one from back home.

SMS 2FA is an awful trend.

Re: LinkedIn password leak

#154

Post by dclowd9901 »

scoot wrote: post #85
wglb wrote: post #50

1: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…

>> test sample passwords with our password checker > Seriously? Sample passwords, not your actual passwords. If you follow that link, they reinforce that with: "Never enter your real password".

Ok... 10,000^4 * 10 = 100,000,000,000,000,000 @1,000,000,000,000 passes per second (nsa level bruting) = 27 hours to break one single password. There's far more low hanging fruit in an encrypted list of passwords than to bother with random common word combos. Unless you're a specific target, it's not lucrative to a hacker to use brute forcing to get through the last 10 or 20% of users with good passwords.

Re: LinkedIn password leak

#155

Post by metafunctor »

discordance wrote: post #125
jasonpeacock wrote: post #52

Also, why is the 2FA option hidden under "Privacy" and not right next to the Change Password option? You'd think they would want to advertise 2FA better...

2FA doesn't mean much if the user can 2FA from one device (i.e. Login to a site from a phone and request the 2FA SMS to the same phone). Something needs to change here.

I disagree. Even if you use the same device to access a service, you still need the device to authenticate. It's authenticating by more than one factor. You need my password, plus my phone, plus possibly a way to access my phone (my PIN code or fingerprint). That's much better than just a password.

Re: LinkedIn password leak

#156

Post by MikeJougrty »

So basically, if I get interviewed by a company and I get asked why I don't have a Linkedin account, am I legitimate to respond to them by saying that Linkedin sucks in many different ways including password breach?

Re: LinkedIn password leak

#157

Post by [deleted] »

lazaroclapp wrote: post #130
kazinator wrote: post #114

> If you’re not sure how strong your password is, test sample passwords with our password checker here. That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one. If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. Don't use the same password on multiple sites.…

> If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. One assumes LinkedIn does not store plain text passwords anywhere. That would be against best practice for the average PhpBB online forum from the late 90s. It would be criminal negligence from a company like LinkedIn. How strong your password is (and which kind of hashing function the site uses) d…

[deleted]

Re: LinkedIn password leak

#158

Post by buovjaga »

Jhsto wrote: post #150
lazaroclapp wrote: post #130

Earlier quoted context omitted.

> If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. One assumes LinkedIn does not store plain text passwords anywhere. That would be against best practice for the average PhpBB online forum from the late 90s. It would be criminal negligence from a company like LinkedIn. How strong your password is (and which kind of hashing function the site uses) d…

The said dump contains unsalted SHA1 encrypted passwords: https://www.leakedsource.com/blog/linkedin

Is there a complete list of the DBs in leakedsource.com somewhere?

They have this result: VerticalScope Network (Vbulletin) (939 Websites). Would be nice to know all of those 939 sites.

Re: LinkedIn password leak

#159

Post by ashitlerferad »

Jhsto wrote: post #150
lazaroclapp wrote: post #130

Earlier quoted context omitted.

> If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. One assumes LinkedIn does not store plain text passwords anywhere. That would be against best practice for the average PhpBB online forum from the late 90s. It would be criminal negligence from a company like LinkedIn. How strong your password is (and which kind of hashing function the site uses) d…

The said dump contains unsalted SHA1 encrypted passwords: https://www.leakedsource.com/blog/linkedin

s/encrypted/hashed/

Re: LinkedIn password leak

#160

Post by [deleted] »

13of40 wrote: post #132
kazinator wrote: post #114

> If you’re not sure how strong your password is, test sample passwords with our password checker here. That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one. If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. Don't use the same password on multiple sites.…

Accounts aren't all created equal. Some of my accounts, such as my domain account at work and my online banking account have real power to screw me over. Some are in the middle, like my LinkedIn account, or my gmail account, since they could be used for social engineering. Some are trivial like my Fark account or my Hacker News account. In that last tier, there's no way it's worth my time to keep rotating those on a…

[deleted]
Post reply on HN