Am I the only one who is too paranoid to decompress a file that I know was created by a black hat...
http://www.symantec.com/avcenter/security/Content/2005.12.21...
6.5 Million LinkedIn Password Hashes Leaked
411–420 of 547 posts
Re: 6.5 Million LinkedIn Password Hashes Leaked
#412Quickly check if your password has been cracked:
http://crackedin.s3-website-us-east-1.amazonaws.com/
It will not send your password over the wire. It won't even send the SHA1 hash over the wire.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#413Use http://leakedin.org to find out if your password was hacked.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#414It's nice to see a page translated through Google on the front page. It's an indication that technology is breaking some barriers.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#415Earlier quoted context omitted.
For the security novices amongst us: I had no idea how to do this so I figured out a quick python script to test it: >>> from hashlib import sha1 >>> def check_pass(plaintext, offset=5): hashed = sha1(plaintext).hexdigest() return (hashed, '0' * offset + hashed[offset:]) >>> check_pass("linkedin") ('7728240c80b6bfd450849405e8500d6d207783b6', '0000040c80b6bfd450849405e8500d6d207783b6') Edit: I'm pretty sure JtR refers…
A complete python script assuming you have hashes.txt in the same directory. http://dpaste.com/756007/
[deleted]
Re: 6.5 Million LinkedIn Password Hashes Leaked
#416Earlier quoted context omitted.
fwiw, this could also be an elaborate hoax, given this facts. E.g. a list of simple password + combinations of the above simple password+"linkedin" variations.
I agree, I've tried several passwords and they match. If you're a Math person, please shed some light on the chances that this list covers the full space.
6.5 million? Off the top of my head, assuming that passwords are only letters and 5 characters long this still wouldn't cover the possible space.
[I think it's safe to ignore hash collisions]
Are you trying passwords you've used on other sites, or random ones? If it's the former, then LI might not be the only source for the file.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#417Earlier quoted context omitted.
Also, there's already an answer in the thread http://news.ycombinator.com/item?id=4073839
It's not an in-depth answer. It does not say, for example, why bcrypt is more secure than nested SHA1. (I believe it has to do with the possibility to efficiently implement SHA algorithms in GPUs.) People are using unsalted SHA1, because someone told them in the past "just use sha1". Now someone else tells them "just use BCrypt". Without understanding why, it's nearly impossible to to decide which security policy is…
Somebody once said fire was composed of phlogistons. Later, different people said that fire was instead a process of decomposing fuel molecules and a release of visible light due to the energy of the chemical chain reactions taking place inside the flame.
The guy who said "phlogistons" was wrong. So was "just use SHA1" guy.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#418Earlier quoted context omitted.
fwiw, this could also be an elaborate hoax, given this facts. E.g. a list of simple password + combinations of the above simple password+"linkedin" variations.
I agree, I've tried several passwords and they match. If you're a Math person, please shed some light on the chances that this list covers the full space.
I'm not a math person either, but here's some fodder for someone who is.
Mark Burnett's extensive password collection (which he acknowledges is skewed, because it's largely based on cracked passwords, he only harvests passwords between 3 and 30 chars, etc.). Here's how some of his stats shake out:
* Although my list contains about 6 million username/password combos, the list only contains about 1,300,000 unique passwords.
* Of those, approximately 300,000 of those passwords are used by more than one person; about 1,000,000 only appear once (and a good portion of those are obviously generated by a computer).
* The list of the top 20 passwords rarely changes and 1 out of every 50 people uses one of these passwords.
So it's conceivable that 6M unique passwords could cover a very significant portion of a 120M user namespace.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#419So LinkedIn... Why are you not using bcrypt to has your passwords?
Re: 6.5 Million LinkedIn Password Hashes Leaked
#420Earlier quoted context omitted.
To expand on that, to store passwords don't just use salt+sha1, or try to do your own nested sha1, just use bcrypt: http://en.wikipedia.org/wiki/Bcrypt
I wonder, why do people saying "just use bcrypt" never, ever bother to elaborate on what benefits it has, and which of them are relevant to the subject of the conversation? Believing in some function without understanding implications of its use does very little for real security.
I wonder why people who make this complaint never ever bother to google: "why use bcrypt". It's like they somehow forget they have the best magical oracle to answer questions at their fingertips, which can answer the question better than most people who understand bcrypt could.