Why is there no notification on their website?
6.5 Million LinkedIn Password Hashes Leaked
181–190 of 547 posts
Re: 6.5 Million LinkedIn Password Hashes Leaked
#182Earlier quoted context omitted.
Easy, just convert all the hashes into passwords using a rainbow table. Should only take a few seconds to convert all 6.5M passwords -- O(n) operation here. Then run all the passwords through each user's password algorithm, this is a O(n^2) operation. Essentially you're making 6.5M password attempts for each of your users. It could be slightly faster because I'm sure there are quite a few duplicates in 6.5M passwords…
A SHA-1 rainbow table?
What's wrong? They exist... they're bigger than md5 tables, but not significantly larger. If you don't have 50GB of free disk space, you could get a table with lower complexity for around 20GB or so.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#183Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…
For the security novices amongst us: I had no idea how to do this so I figured out a quick python script to test it:
>>> from hashlib import sha1
>>> def check_pass(plaintext, offset=5):
hashed = sha1(plaintext).hexdigest()
return (hashed, '0' * offset + hashed[offset:])
>>> check_pass("linkedin")
('7728240c80b6bfd450849405e8500d6d207783b6',
'0000040c80b6bfd450849405e8500d6d207783b6')
Re: 6.5 Million LinkedIn Password Hashes Leaked
#184Has any legitimate sources confirmed that the usernames were also stolen along with these hashes? Or were only the hashes stolen? Could this just be an elaborate hoax where someone generated 6.5M SHA1 hashes and said that they hacked linkedin? Maybe someone shorted LNKD and then leaked this, hoping for a monetary gain?
Someone in this thread stated that his non-common password is hashed on the list so, very unlikely.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#185Re: 6.5 Million LinkedIn Password Hashes Leaked
#186Earlier quoted context omitted.
What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?
Use open-source tools such as SHA1-Pass. The passwords it generates can be recreated with openssl and any other standard crypto library. Edit: I wrote SHA1-Pass, so I'm biased, but I know what you mean about having trust issues with closed-source password tools. That's one of the reasons I wrote it.
I use open source tools such as "pwgen", "emacs" and "gpg". Open up the encrypted file in the editor, type your pass phrase if you haven't this session, cut and paste, close file. The built-in keyboard navigability makes this faster than everything but the in-browser form filling.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#187I have an ignorant question... when a SHA1 encrypted password is cracked, can the hackers actually identify what the unencrypted password is?
I'm guessing no since SHA1 uses a hashing algorithm and only a brute force approach would potentially work...
Re: 6.5 Million LinkedIn Password Hashes Leaked
#188"We were curious what would happen to our share price if our company did something incredibly stupid" The above comment might seem incredibly harsh, but really, there's no good excuse for a site this prominent to not have a salted, secure password hashing system. Even if they started with an unsalted password system, users can be migrated to the newer more secure system on next login. The only way I could regain resp…
Surely just hashing the username|password would massively reduce the effectiveness of leaks like this? Sure, a hacker would know what the "salt" is, but since it now varies between users you would expend the same amount of effort breaking one person's login as you previously would spend breaking everyones (on average). (Not recommending it, just wondering if my reasoning is correct.)
Remember salts don't need to be secret to do their job. The goal is to change the algorithm slightly (by adding additional input) for each user. That means you can't mass-precompute (rainbow tables), and just look up what matches, you have to break each user individually.
Your reasoning about how salts work is correct.
There's also something called a pepper which is another additional bit of input data, that is only stored in the app code (fixed for entire app). So an attacker who only manages to get a database dump would need to guess yet another chunk of data (making it near impossible). So a well-seasoned hash would be SLOW_HASH(pepper+salt+password).
Security is all about layers. Each layer protects a bit more, or prevents things from being easy for the attacker.
Edit: Don't do this yourself. Know it for the theory part - but then just use a well-vetted library to do it.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#189Earlier quoted context omitted.
What's kept me away from such solutions are these questions: How can you trust one service with all your passwords? What if their configuration has a vulnerability?
This is why I use 1password and not LastPass - the encrypted password file is stored locally - optionally in Dropbox, which is what enables moble and remote (http online through Dropbox) to work. Works excellently!
LastPass encrypts your passwords using your master password as (at least part of) the key. This means that they do decryption of passwords client-side as well. The entire password file is not stored locally but they had an intrusion of some sort a number of months back which demonstrated that they have a pretty good system set up along with quite a bit of monitoring. Truecrypt in dropbox is obviously a good choice if you're super paranoid but after seeing LastPass respond to security really well and it having an overall pretty simple UX, I don't have any reason to not recommend it.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#190Earlier quoted context omitted.
Surely just hashing the username|password would massively reduce the effectiveness of leaks like this? Sure, a hacker would know what the "salt" is, but since it now varies between users you would expend the same amount of effort breaking one person's login as you previously would spend breaking everyones (on average). (Not recommending it, just wondering if my reasoning is correct.)
Remember salts don't need to be secret to do their job. The goal is to change the algorithm slightly (by adding additional input) for each user. That means you can't mass-precompute (rainbow tables), and just look up what matches, you have to break each user individually. Your reasoning about how salts work is correct. There's also something called a pepper which is another additional bit of input data, that is only…
Please refer to my comment above. You can precompute a rainbow table if you know the username (trivial) and the method of hashing[1]. Whilst usernames as salts would increase security over no salt, it results in a potential exploit / vulnerability that would not exist if the salt was truly random. Hence, suggesting the use of usernames as salts is not wise.