Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

6.5 Million LinkedIn Password Hashes Leaked

translate.google.com

Post reply on HN
Print view View original

301–310 of 547 posts

Re: 6.5 Million LinkedIn Password Hashes Leaked

#301

Post by jackalope »

Yoms wrote: post #245
riffraff wrote: post #232

Earlier quoted context omitted.

fwiw, this could also be an elaborate hoax, given this facts. E.g. a list of simple password + combinations of the above simple password+"linkedin" variations.

My complex unique password is also on this list (full hash no 5 0's). So nope, not a hoax. Unbelievable/insulting they didn't even bother to salt.

Do you remember when you first used this password at LinkedIn? It could help narrow the dates of the breach. Especially useful would be the presence of a strong password in the list that was subsequently changed. That might help determine its freshness, if the new password isn't present (although this may be an incomplete list from an ongoing breach).

Re: 6.5 Million LinkedIn Password Hashes Leaked

#304

Post by justinhj »

dpritchett wrote: post #281
jgrahamc wrote: post #272

Earlier quoted context omitted.

And.. the node.js solution doesn't do what either the Perl or shell one liners do. It doesn't tell you whether the password was found in the file. All it does is print out a SHA1 hash of a string.

That's a trivial modification: $ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log(x.substring(5));" | xargs -I {} grep {} hashes.txt I'm surprised at the backlash to what I thought was fun code golfing. No one called me names after I posted a simple Python solution that didn't check the file. For what it's worth I've changed my LI password…

node has a neat API for quickly knocking out stuff like this; it's a useful tool for more than just server code. Calling that comment fanboyism is just displaying the opposite of fanboyism, prejudice against hyped-up tools that nevertheless are good tools.

Re: 6.5 Million LinkedIn Password Hashes Leaked

#308

Post by nnnnnnnn »

aqme28 wrote: post #120
tazzy531 wrote: post #80

Good Guy Startup Founder would cross reference this password list with their own password system and force those that match to reauthenticate and change their passwords. This wouldn't be difficult to do and your users would appreciate it.

Better Guy Startup Founder would be using salted hashes anyway and wouldn't even be able to run a cross-reference.

It's possible to test this when your user re-authenticates, assuming you're not using a challenge-response authentication mechanism (as sadly most sites do not).

Re: 6.5 Million LinkedIn Password Hashes Leaked

#309

Post by tptacek »

romaniv wrote: post #125
eropple wrote: post #62

Earlier quoted context omitted.

This isn't really the issue. The real issue is that MD5 (though these hashes are SHA1, which has the same problem) are too easily computed; they are practically byte-forceable. I don't need a rainbow table to compute hashes when I can slam out millions in short order using a GPU. You have a good point about needing to know the salt, but getting the salt is generally easy because it's usually stored in the same place…

Let's forget about bcrypt for a second. What prevents developers from adding a large DB-wide salt (in addition to normal salt) to every password? Wouldn't that prevent bruteforce attacks regardless of the hashing algorithm?

Random nonces have very little to do with what makes SHA1 insecure and bcrypt secure. Developers have a very weird and totally misplaced faith in the ability of random "salts" to secure passwords.
Post reply on HN