A question from the cryptographically uninitiated -- how (and how easily) can these hashes be linked to a user's account name/email?
6.5 Million LinkedIn Password Hashes Leaked
401–410 of 547 posts
Re: 6.5 Million LinkedIn Password Hashes Leaked
#402Earlier quoted context omitted.
on another note, my fairly complex alphanumeric+symbol password IS in the dump, though not prepended truncated with 0's and the other one I found, which my coworker admitted was too short and alpha only, was in the dump with prepended 0's. This could validate the fact that the truncated hashes are actually already cracked.
Mine was 5 characters, alpha and numeric, but no special characters. It was in there, prepended with 0's. Whoops. At the very least, it should have been longer.
Same here - mine was all alpha characters, seven characters, and the hash with five 0's was in the file. Guess who just changed their LinkedIn password today? And included some numbers?
Re: 6.5 Million LinkedIn Password Hashes Leaked
#403My password hash was in the file and it was cracked. It was a combination of 8 upper and lower case letters, digits and special characters. This is the case where size does matter and apparently passwords like my old one can be broken on GPU in minutes or hours nowadays.
Quick sample from persons I polled: 2 password hashes were not in the file, 1 was there and cracked, 1 was there and not cracked yet.
As bad as it is, this can be a great case to raise the awareness of good password management.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#404Earlier quoted context omitted.
Here's node.js: $ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log([x, '00000' + x.substring(5)]);" 7728240c80b6bfd450849405e8500d6d207783b6 0000040c80b6bfd450849405e8500d6d207783b6
Hi - what does " xargs node -e " do? Thank you
[node -e] evaluates a line of node.js source from a command line argument:
$ node -e "console.log('Hello, world.')"
Hello, world.
$ echo /usr/share/dict/words | xargs head -5
A
A's
AOL
AOL's
$ echo petard | xargs -I {} grep {} /usr/share/dict/words
petard
petard's
petards
$ echo is dog this yes | xargs node -e "console.log(process.argv.slice(1).sort().reverse().join(' ').toUpperCase())"
YES THIS IS DOGRe: 6.5 Million LinkedIn Password Hashes Leaked
#405[deleted]
Re: 6.5 Million LinkedIn Password Hashes Leaked
#406I'm starting to think it might be wise, if you intend to reuse your password on multiple sites, to salt it yourself. By using a form like "And yes, yes, I know you shouldn't be reusing your password across different sites, or using a dictionary word anyway. And teenagers also shouldn't be drinking, doing drugs and having sex. It doesn't help anything to pretend that people are going to behave optimally.
Of course, the preposterous restrictions that websites put on passwords, like maximum password length, will make this idea harder to put into practice.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#407My old password was in the password file, and it was flagged as cracked.
If you're a Windows user and you want to check if your password is in the file.
(1) download the passwords file from http://www.mediafire.com/?n307hutksjstow3
(2) the download is a RAR file, so you'll need to have WinRAR installed to extract it.
(3) to get the sha1 version of your password, go to duckduckgo.com and type:
sha1 yourpassword
(4) copy the result, except for the first 6 or so characters
(5) open a DOS command prompt (WindowsKey+R and type CMD)
(6) type (quotes required where indicated): find "sha1hash" sha1.txt
(note: to paste to the command prompt is right-click)
The sha1 hash of the password 'password' is: 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
Remove first six characters: e4c9b93f3f0682250b6cf8331b7ee68fd8
enter at command prompt: find "e4c9b93f3f0682250b6cf8331b7ee68fd8" sha1.txt
result:
---------- SHA1.TXT
000001e4c9b93f3f0682250b6cf8331b7ee68fd8Re: 6.5 Million LinkedIn Password Hashes Leaked
#408Earlier quoted context omitted.
Obligatory shell one-liner: grep `echo -n password | shasum | cut -c6-40` hacked.txt
Prefix the whole command with a space to avoid dumping your password into your bash history: " grep `echo -n yourpassword | shasum | cut -c6-40` SHA1.txt"
Or prompt for it:
grep `read -sp "password: "; echo "$REPLY" | tr -d "\n" | shasum | cut -c6-40` hacked.txtRe: 6.5 Million LinkedIn Password Hashes Leaked
#409Earlier quoted context omitted.
My complex unique password is also on this list (full hash no 5 0's). So nope, not a hoax. Unbelievable/insulting they didn't even bother to salt.
Do you remember when you first used this password at LinkedIn? It could help narrow the dates of the breach. Especially useful would be the presence of a strong password in the list that was subsequently changed. That might help determine its freshness, if the new password isn't present (although this may be an incomplete list from an ongoing breach).
It was about a year ago now. I checked the hashes for my previous password and it wasn't on the list... Mind you, as many have noticed, it seems to be very incomplete.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#41000000fac2ec84586f9f5221a05c0e9acc3d2e670
0000022c7caab3ac515777b611af73afc3d2ee50
deb46f052152cfed79e3b96f51e52b82c3d2ee8e
00000dc7cc04ea056cc8162a4cbd65aec3d2f0eb
00000a2c4f4b579fc778e4910518a48ec3d2f111
b3344eaec4585720ca23b338e58449e4c3d2f628
674db9e37ace89b77401fa2bfe456144c3d2f708
37b5b1edf4f84a85d79d04d75fd8f8a1c3d2fbde
00000e56fae33ab04c81e727bf24bedbc3d2fc5a
0000058918701830b2cca174758f7af4c3d30432