Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn password leak

usblog.kaspersky.com

Post reply on HN
Print view View original

31–40 of 218 posts

Re: LinkedIn password leak

#31

Post by 1024core »

zaroth wrote: post #23
pdq wrote: post #18

Earlier quoted context omitted.

Link: https://password.kaspersky.com/ I'm impressed by the password cracking estimation with the Tianhe-2 Supercomputer. A 10-character password containing uppercase letters, lowercase letters, and numbers, which is estimated at a 4 year crack with a Macbook Pro, takes 31 seconds on the supercomputer.

The timing are meaningless since it depends entirely on the hashing algorithm and how much key stretching was in place. Is even the basic ratio/multiplier correct? Supercomputer is 1,000,000x faster than a 2012 MacBook Pro? I tried a few random strings and saw ratios as high as 3,000,000 - why would the ratio change based on the password? Probably because the number is nonsense.

> why would the ratio change based on the password?

Probably because they may assume a dictionary order of cracking attempts?

Re: LinkedIn password leak

#32

Post by redbergy »

cfontes wrote: post #28
hayleox wrote: post #6

Woo, I created my LinkedIn profile in 2015, so I should be safe since the leak is supposedly from 2012. If anyone else isn't sure when they made their LinkedIn, you can see your join date here (ctrl+f "Member since"): https://www.linkedin.com/psettings/

2009... Awesome. Linkedin should probably be the one warning me about this, but I never heard of this before. Edit: filtered as Spam, nevertheless they should have locked my account.

I received multiple emails this morning from LinkedIn advising me to change my password.

Re: LinkedIn password leak

#35

Post by [deleted] »

benologist wrote: post #27

I got an email from them this morning about this, it just smells like all their other junkmail begging me to +1 their active users. Why don't they invalidate the passwords all at once instead of letting -- someone -- use the potentially compromised passwords again...

[deleted]

Re: LinkedIn password leak

#36

Post by acomjean »

Tharkun wrote: post #11

I got an e-mail from LinkedIn today saying that I would be forced to reset my password upon my next login. They didn't say why. I guess this explains it.

I got an email too this morning too.

They invalidated my password.

My session was intact, but a password reset was required on next login, and they encourage two factor. I did that despite not really wanting linkedin having my phone number...

When you change the password, you can click a box to inactivate all other sessions.

Re: LinkedIn password leak

#38

Post by ufo »

pdq wrote: post #18
jedmeyers wrote: post #4

> test sample passwords with our password checker here. Do NOT do that with your exact password though :)

Link: https://password.kaspersky.com/ I'm impressed by the password cracking estimation with the Tianhe-2 Supercomputer. A 10-character password containing uppercase letters, lowercase letters, and numbers, which is estimated at a 4 year crack with a Macbook Pro, takes 31 seconds on the supercomputer.

Looks like they are using zxcvbn[1] to calculate the password entropy and converting it to a time with these parameters:

    computers               speed factor
    ------------------------------------------------
    ZX Spectrum             k: 1300    // 30 guesses per hour (?)
    Mac Book Pro (2012)     k: 1       // 10 guesses per second (?)
    Conficker botnet        k: 5e-5    // 20000 guesses per second (?)
    Tianhe-2 Supercomputer, k: 3e-7    // 3000000 guesses per second (?)
The following line of code suggests that the speed factor is compared to 10 password guesses per second:

    Passwrdr.crack_time = result['crack_times_seconds']['online_no_throttling_10_per_second'];
[1] https://github.com/dropbox/zxcvbn

Re: LinkedIn password leak

#39

Post by zaroth »

1024core wrote: post #31
zaroth wrote: post #23

Earlier quoted context omitted.

The timing are meaningless since it depends entirely on the hashing algorithm and how much key stretching was in place. Is even the basic ratio/multiplier correct? Supercomputer is 1,000,000x faster than a 2012 MacBook Pro? I tried a few random strings and saw ratios as high as 3,000,000 - why would the ratio change based on the password? Probably because the number is nonsense.

> why would the ratio change based on the password? Probably because they may assume a dictionary order of cracking attempts?

I mean, why would the supercomputer sometimes be 1,000,000 times faster and then for a different password be 3,000,000 times faster?

Re: LinkedIn password leak

#40

Post by ufo »

zaroth wrote: post #23
pdq wrote: post #18

Earlier quoted context omitted.

Link: https://password.kaspersky.com/ I'm impressed by the password cracking estimation with the Tianhe-2 Supercomputer. A 10-character password containing uppercase letters, lowercase letters, and numbers, which is estimated at a 4 year crack with a Macbook Pro, takes 31 seconds on the supercomputer.

The timing are meaningless since it depends entirely on the hashing algorithm and how much key stretching was in place. Is even the basic ratio/multiplier correct? Supercomputer is 1,000,000x faster than a 2012 MacBook Pro? I tried a few random strings and saw ratios as high as 3,000,000 - why would the ratio change based on the password? Probably because the number is nonsense.

The ratio is always 3000000 (I checked the Javascript Source). The discrepancy you see might have to do with the rounding that happens when they convert the time to a human-readable representation.
Post reply on HN