You can generate your own SHA1 for your password and check if it's existing in the txt file.
6.5 Million LinkedIn Password Hashes Leaked
51–60 of 547 posts
Re: 6.5 Million LinkedIn Password Hashes Leaked
#52This makes me wonder. I've been relying on Django's built in user authentication lately. Does anyone know if that's pretty safe? Is it doing the right thing for hashing passwords?
Disclaimer: I am not a cryptographic expert. https://docs.djangoproject.com/en/dev/topics/auth/ Django by default uses the PBKDF2 algorithm, which is better than nothing/md5/no salt sha1. I'd use bcrypt or scrypt by default, better be safe than sorry.
> which is better than nothing/md5/no salt sha1.
It's also better than salted sha1 since it performs multiple iteration rounds leading to (configurable) higher computational complexity.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#53I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.
... but still, a head wag at LinkedIn for using weak hashing, which I'm guessing means MD5.
MD5 isn't the issue - it's the lack of salting. Without a salt, almost any hash can be cracked with a rainbow table. With a salt, you'd need to know the salt for each hash, and then generate a new rainbow table, in order to recover the original password.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#54This makes me wonder. I've been relying on Django's built in user authentication lately. Does anyone know if that's pretty safe? Is it doing the right thing for hashing passwords?
Disclaimer: I am not a cryptographic expert. https://docs.djangoproject.com/en/dev/topics/auth/ Django by default uses the PBKDF2 algorithm, which is better than nothing/md5/no salt sha1. I'd use bcrypt or scrypt by default, better be safe than sorry.
PBKDF2 is way better than salted hashes. It's right there with bcrypt and scrypt on the "good choices" list.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#55I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.
LinkedIn could easily match each hash to a user. Then they should lock each of those accounts and force them to change their password.
Which should be done, but which doesn't help those users where it matters most; the real value of this database is that some people (~everyone) reuses passwords across sites.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#56Earlier quoted context omitted.
You can use it for checking whether your password was leaked. You don't need usernames for that.
Are the hashed passwords not salted?
You can perform this check even if they were salted.
Otherwise how could linkedin check if you correctly entered your password?
The salt is contained in cleartext as part of the hashed password, so that you can repeat the hashing the secret and match the two hashes.
The salt improves the security because:
1. even if two users use the same password, you cannot tell that by simply comparing the hashes
2. makes brute force checks much slower because you have to recompute the hash for every hashed password entry rather than once for every dictionary entry
3. Prevents building rainbow tables
(probably other reasons, I'm not a crypto expert)
Re: 6.5 Million LinkedIn Password Hashes Leaked
#57Earlier quoted context omitted.
LinkedIn could easily match each hash to a user. Then they should lock each of those accounts and force them to change their password.
Which should be done, but which doesn't help those users where it matters most; the real value of this database is that some people (~everyone) reuses passwords across sites.
And send them a note too, sure. They've got their e-mail addresses as well so a note of apology and warning is certainly in order.
Re: 6.5 Million LinkedIn Password Hashes Leaked
#58What riddles me though, is how come 6.5 million?
LinkedIn has what, 150M users?
Did they not post the entire load (and are in fact sitting on _all_ the hashes?) Is the dump an old backup or breach from when they had fewer accounts? Is it just one DB partition / file that's been lost, an archive?
Re: 6.5 Million LinkedIn Password Hashes Leaked
#59I've just downloaded the database linked and it only contains the hashed passwords, not the account usernames / e-mail addresses. I wonder if someone has the account details to match up otherwise you've no idea which password belongs to who, and you'd hope that LinkedIn would have lockout functionality.
To get a sense of it, I downloaded it from a link here. Below is the structure of the first few lines. Caveat: it's garbage/useless data below -- I intentionally changed around the actual numbers to give a sense of the structure, only:
000000a94d47b9cb82ca8a3b492a51263b40a66e 000000a98a624314892af97c6f1a0635472eae38 000000a9ba60e7f13fcac444a5a791af7807a3a3 000000a97ea34e74a97a6d1ce08ebc68d3e9aab2 000000a9b4b2a3497aaa51e212ac9efdb00aaf4e
Re: 6.5 Million LinkedIn Password Hashes Leaked
#60This makes me wonder. I've been relying on Django's built in user authentication lately. Does anyone know if that's pretty safe? Is it doing the right thing for hashing passwords?
I'm not an authority on this, but django_bcrypt is generally considered a best-practice in the Django community. Scrypt may replace that in the future, once implementations are widely available and battle-tested.