511–520 of 547 posts
Earlier quoted context omitted.
Obligatory perl one-liner: perl -MDigest::SHA -le '$h = substr( Digest::SHA::sha1_hex($ARGV[0]) , 5 ); open F, " )' password (for people without shells)
By sheer coincidence I had a chance to use Perl again today for a job interview. I now have a good appreciation of why it's considered a "Write once, read never" language. :)
Earlier quoted context omitted.
[node -e] evaluates a line of node.js source from a command line argument: $ node -e "console.log('Hello, world.')" Hello, world. [xargs] allows you to pipe the output of one command as an argument to another command. By default it will show up at the tail end of the second command's arg list, but if you want to interleave it you can use -I flag: $ echo /usr/share/dict/words | xargs head -5 A A's AOL AOL's $ echo pet…
head -5 /usr/share/dict/words same result as with xargs grep petard /usr/share/dict/words same result as with xargs not sure what you are trying to demonstrate here useless use of xargs?
Are you even reading this discussion properly or are you just searching for some shell snippets and ridicule them as soon as you get a chance? This is what it looks like from your history: http://news.ycombinator.com/threads?id=uselessuseof
ionwake doesn't want to learn how to search a word. He wants to know how 'xargs node -e' works. Please read this again: http://news.ycombinator.com/item?id=4075293
Earlier quoted context omitted.
For the security novices amongst us: I had no idea how to do this so I figured out a quick python script to test it: >>> from hashlib import sha1 >>> def check_pass(plaintext, offset=5): hashed = sha1(plaintext).hexdigest() return (hashed, '0' * offset + hashed[offset:]) >>> check_pass("linkedin") ('7728240c80b6bfd450849405e8500d6d207783b6', '0000040c80b6bfd450849405e8500d6d207783b6') Edit: I'm pretty sure JtR refers…
A complete python script assuming you have hashes.txt in the same directory. http://dpaste.com/756007/
Earlier quoted context omitted.
My complex unique password is also on this list (full hash no 5 0's). So nope, not a hoax. Unbelievable/insulting they didn't even bother to salt.
Unbelievable/insulting they used a general purpose, easily reversible hash like SHA1 in the first place. I would have thought everyone had seen the 'use bcrypt' page by now. http://codahale.com/how-to-safely-store-a-password/
Salting should have been fine.
Earlier quoted context omitted.
A hash is not a password. At worst you're giving the attacker a hash target to try brunting. He still has to brute it, and that takes time. Select your plaintext from a large enough keyspace and it's astronomical time. I'll need to review their policy more closely, but DDG claim fairly minimal tracking. At best someone might be able to correlate hash lookup with some IP space. That's a long way from handing over pass…
No, no, no. You're 100% completely misunderstanding this. When you search for 'sha1 foo', that query ("sha1 foo") goes up to the server. They know your password is "foo" and that you're attempting to "sha1" it. They don't have a hash, they take that data and perform the hash, then send that down to you .
OK, gotchya.
I guess I'm just too damned used to using systems that, you know, have useful tools installed locally (or can get them there really damned fast). Including SHA1 and MD5 hash generators.
And I was all worked up to tell you how wrong you were still being.
All because I couldn't fathom the possibility let alone reason anyone would need a third-party site to compute their hashes for them.
Silly me, my error.
So I guess it is only a subset of all the linkedin passwords?
I have now changed my passwords anyway.
By the way, the press say both the username and password were hacked, has anyone seen the list of usernames? They also say 6.4m passwords were hacked but this file only has 6.14m.
Earlier quoted context omitted.
Obligatory shell one-liner: grep `echo -n password | shasum | cut -c6-40` hacked.txt
obligatory comments - not portable - useless use of backticks printf password|openssl sha1|cut -c6-40|grep -f - hacked.txt
It's been more than 12 hours, and the access token for the mobile client is still connected to my account, despite changing my password.
I would expect all tokens to be revoked on-password-change. Really disappointing.
I'll have to set up an SSL proxy later to dump the traffic from Android, see what is happening. Anyone compiled SSLDump for Android?
It's been more than 12 hours, and the access token for the mobile client is still connected to my account, despite changing my password.
I would expect all tokens to be revoked on-password-change. Really disappointing.