Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn password leak

usblog.kaspersky.com

Post reply on HN
Print view View original

171–180 of 218 posts

Re: LinkedIn password leak

#171

Post by ryuuchin »

13of40 wrote: post #132
kazinator wrote: post #114

> If you’re not sure how strong your password is, test sample passwords with our password checker here. That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one. If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. Don't use the same password on multiple sites.…

Accounts aren't all created equal. Some of my accounts, such as my domain account at work and my online banking account have real power to screw me over. Some are in the middle, like my LinkedIn account, or my gmail account, since they could be used for social engineering. Some are trivial like my Fark account or my Hacker News account. In that last tier, there's no way it's worth my time to keep rotating those on a…

> It wouldn't be even that much of a crime to use the same password on them, since there's virtually no way someone's going to pivot from a Fark account into my bank account. So quit being so dogmatic is what I'm saying.

This is 2016, we have password managers. Using different passwords for each site shouldn't be any more difficult than if you had not. Even using the built in ones in your browser of choice is better than not using one at all and makes using site specific passwords easy. Chrome even has a built in password generator for you, I assume this is using your operating systems CSPRNG (or BoringSSL's?) although I'm not 100% sure about that.

Re: LinkedIn password leak

#172

Post by zamalek »

yoha wrote: post #165
ben_jones wrote: post #148

Earlier quoted context omitted.

We have to rotate our password advice to family and friends every couple years or so. It used to be "use a random combination of memorable words with a number thrown in" a la "reddogbarkhard7". Now I feel like right after guessing the 10k most common passwords a hacker would immediately brute word combinations with a single integer ending.

The worst bias is letting the users choose their passwords. They should use a generator such as [1]. The reason is that the "entropy" is not a characteristic of a password but of the way it is generated. Computers are much better at entropy than humans. [1] http://passwordcreator.org/

Or, better yet, a password manager. If you aren't using one yet, now is a great opportunity.

Re: LinkedIn password leak

#173

Post by sleepychu »

eru wrote: post #144
semi-extrinsic wrote: post #65

Earlier quoted context omitted.

I believe it's been proven impossible to write a spam filter to distinguish useful LinkedIn email from spammy LinkedIn emails, since the spam filter would then be able to solve the halting problem.

Can't you just write this?: isUseful :: LinkedInMessage -> Bool isUseful _ = False

Sure, but password leak is pretty useful.

Re: LinkedIn password leak

#174

Post by pdw »

beberlei wrote: post #128
chronial wrote: post #63

Earlier quoted context omitted.

How do you randomly generate these passwords?

you can install a tool "pwgen" on linux machines that will generate you passwords, configurable with size and types of characters included. pwgen -y 40 1 Generates one password with 40 chars, including special chars (-y).

    head -c 24 /dev/urandom | base64
will give you a password with 24 * 8 = 192 random bits.

Re: LinkedIn password leak

#176

Post by [deleted] »

13of40 wrote: post #132
kazinator wrote: post #114

> If you’re not sure how strong your password is, test sample passwords with our password checker here. That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one. If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. Don't use the same password on multiple sites.…

Accounts aren't all created equal. Some of my accounts, such as my domain account at work and my online banking account have real power to screw me over. Some are in the middle, like my LinkedIn account, or my gmail account, since they could be used for social engineering. Some are trivial like my Fark account or my Hacker News account. In that last tier, there's no way it's worth my time to keep rotating those on a…

[deleted]

Re: LinkedIn password leak

#178

Post by prof_hobart »

rpgmaker wrote: post #138
jasonkostempski wrote: post #135

Earlier quoted context omitted.

"Some are in the middle, like my LinkedIn account, or my gmail account" Your email account is the golden key to all other accounts that send "forgot password" links to it.

I don't use it myself but I would think that you wouldn't want your "professional" social network account to fall in the wrong hands either.

You don't, and it can be embarrassing. I've seen it happen with a colleague.

But what happened was embarrassment, not their life savings being wiped out.

Re: LinkedIn password leak

#179

Post by Ntrails »

yoha wrote: post #165
ben_jones wrote: post #148

Earlier quoted context omitted.

We have to rotate our password advice to family and friends every couple years or so. It used to be "use a random combination of memorable words with a number thrown in" a la "reddogbarkhard7". Now I feel like right after guessing the 10k most common passwords a hacker would immediately brute word combinations with a single integer ending.

The worst bias is letting the users choose their passwords. They should use a generator such as [1]. The reason is that the "entropy" is not a characteristic of a password but of the way it is generated. Computers are much better at entropy than humans. [1] http://passwordcreator.org/

Work sent around a stupid cardboard stand which was supposed to tell us all about being excellent at our work, and the checking processes required before sending anything to clients etc etc.

We were changing domains at the same time, so my new password root is now based on the first three characters of the first 3 lines of the thing, which included some punctuation, then the standard numeral to increment every 90 days.

My password was in plain sight for a couple months before I got around to binning it, which actually makes life a lot easier. Especially when you're not using it often enough for it to be muscle memory - which is the problem my parents face.

Re: LinkedIn password leak

#180

Post by PostThisTooFast »

lazaroclapp wrote: post #130
kazinator wrote: post #114

> If you’re not sure how strong your password is, test sample passwords with our password checker here. That is irrelevant in the face of leaked passwords; what matters most in that situation is that your password is something other than your leaked one. If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. Don't use the same password on multiple sites.…

> If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. One assumes LinkedIn does not store plain text passwords anywhere. That would be against best practice for the average PhpBB online forum from the late 90s. It would be criminal negligence from a company like LinkedIn. How strong your password is (and which kind of hashing function the site uses) d…

LinkedIn still implements this moronic policy, which makes every breach worse: http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use...
Post reply on HN