I confirmed mine is in the dump as well
Mine as well, unbroken (not prefixed with the 00000) in the original file.
6.5 Million LinkedIn Password Hashes Leaked
221–230 of 547 posts
Re: 6.5 Million LinkedIn Password Hashes Leaked
#222Some observations on this file: 0. This is a file of SHA1 hashes of short strings (i.e. passwords). 1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact. Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters…
I've had the same password on linkedin for as long as I remember and neither the full hash nor the zero prefix edited was found in the dump.
Simple line used in OS X terminal:
grep -e "`echo -n "your pass" | openssl sha1`" combo_not.txt
Re: 6.5 Million LinkedIn Password Hashes Leaked
#223"We were curious what would happen to our share price if our company did something incredibly stupid" The above comment might seem incredibly harsh, but really, there's no good excuse for a site this prominent to not have a salted, secure password hashing system. Even if they started with an unsalted password system, users can be migrated to the newer more secure system on next login. The only way I could regain resp…
Regarding requiring users to log in; wouldn't it be better to run their current hash through another password hashing scheme (while we're at it bcrypt, scrypt, PBKDF, etc)? Then, the next time they log in, verify them by running their password through the old algorithm, and the result through the new one.
Yep. Here is a treatment of that: https://gist.github.com/1051238
Re: 6.5 Million LinkedIn Password Hashes Leaked
#224Earlier quoted context omitted.
For the security novices amongst us: I had no idea how to do this so I figured out a quick python script to test it: >>> from hashlib import sha1 >>> def check_pass(plaintext, offset=5): hashed = sha1(plaintext).hexdigest() return (hashed, '0' * offset + hashed[offset:]) >>> check_pass("linkedin") ('7728240c80b6bfd450849405e8500d6d207783b6', '0000040c80b6bfd450849405e8500d6d207783b6') Edit: I'm pretty sure JtR refers…
Obligatory perl one-liner: perl -MDigest::SHA -le '$h = substr( Digest::SHA::sha1_hex($ARGV[0]) , 5 ); open F, " )' password (for people without shells)
Obligatory shell one-liner:
grep `echo -n password | shasum | cut -c6-40` hacked.txtRe: 6.5 Million LinkedIn Password Hashes Leaked
#225Earlier quoted context omitted.
If your password was 'linkedinsucks' then it sucks because they found it already !
Correct! 527688fa9f32bb8dab32d30807ca5c57a0b203b8 is not present 000008fa9f32bb8dab32d30807ca5c57a0b203b8 is present
Here's some they didn't find, from /usr/dict/words: Paraná, Zürich, attaché. Not sure of the encoding, but I'd guess UTF-8.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#226Earlier quoted context omitted.
I hear this commonly, so it is a good idea to clear it up. Usernames have lower entropy than a random salt and are predictable in many cases. People re-use usernames and some usernames are common. If your password system became common on the web, or if I knew the workings of your password system (i.e. open source / leaked codebase / Kerckhoffs's principle[1]), I could generate a rainbow table for either common or tar…
Often people say "Don't roll your own security" but the reality is that developers aren't trying to roll their own. They are trying to solve a problem, and if a quick google doesn't turn up a good library then they'll try and figure it out. Googling for password security implementations is likely to be fraught with horrible horrible advice. I guess what I'm saying is that it's not enough to say don't do it, instead t…
I think we've reached a point with bcrypt that a good secure password system is within reach and comes with sane defaults and ease of use as features for most programming languages.
If it's just an issue of getting the word out there, then I'm hopeful things can improve.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#227Earlier quoted context omitted.
To expand on that, to store passwords don't just use salt+sha1, or try to do your own nested sha1, just use bcrypt: http://en.wikipedia.org/wiki/Bcrypt
I wonder, why do people saying "just use bcrypt" never, ever bother to elaborate on what benefits it has, and which of them are relevant to the subject of the conversation? Believing in some function without understanding implications of its use does very little for real security.
Because the answer to your question is one Google search away. HN people are tired of explaining it every single time bcrypt comes up.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#228Earlier quoted context omitted.
I've always wondered this about services like lastpass. What stops being hacked / keyloggered and them exfiltrating all your long, complex passwords?
Nothing, really. However, I trust the LastPass guys to keep their shit secure as much as I trust myself to keep my own system secure. After all, if my own system is compromised, I just get a lot of hassle. If LastPass ever gets hacked and leaks their passwords, they lose their business overnight. That's pretty good motivation for them to keep on top of their stuff. I used to use 1Passwd, which stored the passwords in…
The big difference between "hosted service" and "encrypted file in the cloud" is that the hosted service has, by definition, to store the key next to the lock to be practical.
The key for your encrypted file stays in your head (and/or in your wallet), so even a full-on total breach of Dropbox/iCloud, your key is safe, and 8 million rounds of 265-bit AES and a good password (my current KeePass settings) is still unbreakable[1].
1: Unless (perhaps) you have the attention of certain governments. And they always have the option of using a $5 wrench on you, anyway.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#229I wonder, what if this list wasn't leaked from LinkedIn databases, but rather from some third-party service using the "enter your password" anti-pattern? A flaky service like that would likely not be very good at safely storing passwords.
Unfortunately, LinkedIn keeping mum on the subject makes it easy to speculate that it was actually coming from them. Otherwise it'd be easy to deny (and even spin: "How dare you! We never store unsalted hashes, we follow state-of-the-art practices here!!"). Also, their security track record is... embarrassing as it is.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#230> - With a computer of 8,000 NOK (~ 1400 USD), you can do a few hundred million attempts per second. Are you kidding me? LinkedIn stored their passwords using (salted) SHA1 using no iterations? Jesus.
No they didn't salt them either haha!