LinkedIn Password Hashes Leaked Online 271
jones_supa writes "A user in a Russian forum is claiming to have hacked LinkedIn to the tune of almost 6.5 million account details. The user uploaded 6,458,020 SHA-1 hashed passwords, but no usernames. Several people have said on Twitter that they found their real LinkedIn passwords as hashes on the list. The Verge spoke with Mikko Hyppönen, Chief Research Officer at F-Secure, who thinks this is a real collection. He told us he is 'guessing it's some sort of exploit on their web interface, but there's no way to know.' We will have to wait for LinkedIn to report back to be sure what exactly has happened."
An anonymous reader tipped us to related news: The LinkedIn iOS application harvests information from your calendar and transmits it to their servers unencrypted.
It's not an exploit, it's a feature! (Score:5, Funny)
Re: (Score:3)
But, where is the leaked list ?
Comment removed (Score:5, Interesting)
Re:It's not an exploit, it's a feature! (Score:5, Interesting)
LinkedIn - A Networking Tool (Score:3)
I'm retired but I do have a LinkedIn account and am "connected" to a lot of people in my old profession. Several people I know got very nice jobs through LinkedIn. One got a job as Director of Global Quality for a large Chinese company (and this person is from India) and has quite a nice salary.
I'm not much for social networks, and I don't spend time on LinkedIn but I use it and I personally think it's a good tool for many professionals. I have never gotten any spam from LinkedIn or LinkedIn "members'.
Plain text (Score:5, Funny)
This sort of vulnerability is exactly why I avoid storing passwords in hash form. I always store passwords in plain text form. It's much more secure.
Re:Plain text (Score:5, Funny)
This sort of vulnerability is exactly why I avoid storing passwords in hash form. I always store passwords in plain text form. It's much more secure.
Y'know what fools the black-hats every time? Store the passwords in plaintext; but require all users to create a password consisting of exactly 64 hexadecimal characters... Even better, we all know that users hate security, so more user hatred = more secure. And this system is Super Secure.
Re:Plain text (Score:5, Funny)
Won't work, local policy prevents repeated numbers, and letters must be a mix of upper and lower case, and no sequential numbers. (I only wish I were kidding)
Re: (Score:3)
Re:Plain text (Score:4, Insightful)
i.e. Only attempt passwords with 6 to 8 characters and filter out any where # of capitol letters is < 1 or > 1 and # of numbers !=2. I'm sure it's still a large sample but infinitesimally smaller than just requiring a password to be more than 6 characters.
Re: (Score:2)
Re:Plain text (Score:5, Interesting)
That's nothing.
http://kottke.org/12/06/the-worlds-worst-password-requirements-list [kottke.org]
Re:Plain text (Score:5, Funny)
Re: (Score:2)
And no numbers that could be letter substitutes.
So no 0,1,2,3,4,5,6,7,8 or 9 is allowed. You must include numbers not in this set. (Also please remember that NaN is not a number and thus does not satisfy the numeric requirement).
Re: (Score:3, Funny)
The password "Password" is not allowed, but "pissword" is because it contains a number!
Re: (Score:3)
Re:Plain text (Score:5, Informative)
Considering that LinkedIn was storing the passwords unsalted [theverge.com], it's really not much better than plaintext.
The only question at this point is whether their "security" team suffers from mild, or severe learning disabilities.
Good! (Score:5, Funny)
Could someone please look up my password for me? (Score:2)
I haven't logged into linkedin for so long, that I don't remember my password anymore.
And I blocked emails from *@linkedin.com as spam, because, well, they're basically all spam. I can't be bothered to unblock and do email based password recovery.
Could some Russian friend please look up my password for me, and reply back?
K thx bye
Re:Could someone please look up my password for me (Score:5, Funny)
Try the following password: 12345
Sincerely Boris
Re:Could someone please look up my password for me (Score:5, Funny)
Thank you Boris, but that is my luggage combination, not my linkedin password.
Admittedly my luggage is more important to me than my linkedin account, but...
Re: (Score:3)
Re:Could someone please look up my password for me (Score:5, Funny)
I can clearly see that it's hunter2.
Re: (Score:2)
Just like Shakespeare is better when read in the original klingon, thats funnier in the original TDWTF ... the password is hunter fourty two pound... No not the octothorpe sign, pound sign!
So what? (Score:2)
What are you going to do with millions of password hashes, even without usernames none the less?
Re:So what? (Score:5, Insightful)
Re: (Score:2)
What are you going to do with millions of password hashes, even without usernames none the less?
I've occasionally daydreamed a fun academic paper would be to collect sets of password hashes, rub them up against a rainbow table, and make graphs and correlations and wild assumptions about the correlation coeff of IQ and rate of easily cracked pwd vs site etc etc. Sounds like fun so its probably been done before.
Re:So what? (Score:5, Informative)
I've occasionally daydreamed a fun academic paper would be to collect sets of password hashes, rub them up against a rainbow table, and make graphs and correlations and wild assumptions about the correlation coeff of IQ and rate of easily cracked pwd vs site etc etc. Sounds like fun so its probably been done before.
Yes, it's been done on 70 million passwords. See http://www.cl.cam.ac.uk/~jcb82/doc/B12-IEEESP-analyzing_70M_anonymized_passwords.pdf [cam.ac.uk]
Re:So what? (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Question - how do you get passwords back from one-way hashes, given that each hash can be generated from an infininate number of original values?
Re: (Score:3)
You generate hashes until you match the target hash. It's possible that your original value is different than the actual password. But they hash the same so it doesn't matter : )
Re: (Score:3)
Re: (Score:3)
The initial break of the hash is either done via a pre-gen rainbow table (which contains pairs of passwords and their hashes) or by brute-force approach (work through possible passwords, hash them, compare against the list of hashes, spit out the matches).
Re: (Score:3)
LinkedIn uses e-mail addresses as usernames. Getting access to a crapload of valid e-mail addresses to test against is trivial.
Re: (Score:2)
What are you going to do with millions of password hashes, even without usernames none the less?
How do you suppose all the people mentioned on Twitter who verified their passwords in the list were correct did so if they couldn't find their hash in the list?
Of bigger concern to me is not the loss of the passwords, but the loss of the e-mail addresses (usernames). That's a VERY long list of valid, valuable e-mail accounts.
Colour me surprised! (Score:5, Interesting)
Just remember, it has never been about convenience to the user, and always profitability to the provider.
Re:Colour me surprised! (Score:5, Insightful)
Exfiltrating the data in the clear is certainly easy enough(luckily 'mobile' frequently means 'even if I were competent enough, my crypto-crippled appliance wouldn't let me control outbound traffic anyway') but it makes it likely that, sooner or later, somebody is going to sniff some packets at their router and we'll get a little story about exactly how much exfiltration your ghastly little app is doing.
It's like corruption. Even when everybody knows that it is happening, it is still considered crass to get caught with your hand in the cookie jar. You are supposed to pretend to care.
Re: (Score:3)
That's a ridiculous thing to say. There are a lot of factors that go into deciding between a native and a mobile web app, and it certainly doesn't simply boil down to "they want to steal your data".
Again, you don't know what you are talking abo
Re: (Score:2)
Android and iOS both have permissions and protections in place to prevent apps from accessing personal data such as Contacts and Location. Although there have been incidents of breaches, the protections work most of the time. Android also sandboxes the apps, and although I'm not 100% sure I believe that iOS does so as well.
What is it about the Windows Phone implementation specifically that is so different and presumably better?
Re: (Score:2)
Android and iOS both have permissions and protections in place to prevent apps from accessing personal data such as Contacts and Location. Although there have been incidents of breaches, the protections work most of the time. Android also sandboxes the apps, and although I'm not 100% sure I believe that iOS does so as well.
What is it about the Windows Phone implementation specifically that is so different and presumably better?
And for Android the user has to give permission for the app to be able to do things like access the Contacts, SD Card, and such - any inter-app communication must be approved by the user when the app is installed. Too often, people don't pay attention to what they are granting though.
A New Euphemism! (Score:5, Funny)
"Harvested" -- I love it!
"Bernie Madoff harvested money from his investors."
"H.I. harvested diapers from the convenience store."
"LinkedIn harvested private data from my phone."
They're doing you a favor by "harvesting". Because it's not doing anyone any good if it remains "unharvested".
Re: (Score:3)
You can also use "leaked" in the reverse sense!
"Investors leaked money to Bernie Madoff"
"The convenience store leaked diapers to H.I."
"My phone leaked private data to LinkedIn"
Re: (Score:3)
What are you suggesting it is a euphemism for?
We can't call it stealing while simultaneously taking the stance that copying MP3s (or any other data) isn't stealing because the original data has not been lost to the original owner.
Re: (Score:2, Informative)
harvest
[hahr-vist] Show IPA
noun
1. Also, harvesting. the gathering of crops.
2. the season when ripened crops are gathered.
3. a crop or yield of one growing season.
4. a supply of anything gathered at maturity and stored: a harvest of wheat.
5. the result or consequence of any act, process, or event: The journey yielded a harvest of wonderful memories.
verb (used with object)
6. to gather (a crop or the like); reap.
7. to gather the crop from: to harvest the fields.
8. to gain, win, acquire,
broken glass all over the road (Score:5, Insightful)
As an IT/security guy reading about these seemingly constant ongoing password change requests, I can't help but think that the problem lies not only with how many special characters we're using in our passwords, or whether or not we're using our pet's name, but more so in how the infrastructures of all of these magically eutopian social networks are storing this information. Correct me if I am wrong, but haven't the majority of the recent problems that have forced us all to change our passwords, whether it is LinkedIn, World of Warcraft or whatever been due to leaks from the back-end, not poor Johnny at the keyboard giving it to Ivan the hacker (no offense to the real Ivans or Johnnys)? Kind of like having to keep replacing the car tires because the roads are made of broken glass. Its not my fault, but I have to suffer. It would seem we need to put more PCI/SOX/whatever-like standards in place to better protect and mandate how our information is stored as more and more encouragement is put in place to unzip our metaphorical zippers online.
And for the record, I am not an anonymous coward, but I forgot my password and my email isn't the same as it was 8+ years ago when I set up my slashdot account...
ignorance is bliss in this case :)
Re:broken glass all over the road (Score:5, Insightful)
Why do you hate America, you godless communist?
Re: (Score:2)
I really hate to link xkcd but they are on the money with this one.
http://xkcd.com/936/ [xkcd.com]
I'm getting tired of having to have ridiculous passwords, now I'm just either ALWAYS making the first character an uppercase because it's easier, or doing quick pattern based passwords for the ultra fussy systems.
123qwe!@#QWE - that's surprisingly quick to input yet keeps those stupid systems quiet.
Passfault Is an Eye-Opener (Score:2)
I really hate to link xkcd but they are on the money with this one.
http://xkcd.com/936/ [xkcd.com]
I'm getting tired of having to have ridiculous passwords, now I'm just either ALWAYS making the first character an uppercase because it's easier, or doing quick pattern based passwords for the ultra fussy systems.
123qwe!@#QWE - that's surprisingly quick to input yet keeps those stupid systems quiet.
They can have my linked-in hash. Based on a similar pattern is should take 11945132084526 centuries to crack according to passfault [appspot.com].
For the lame systems that insist on bad passwords, I just generate something random in keepassX
Re: (Score:2)
No, it's a good idea to force users to have different types of characters in their passwords. That's exactly because of this kind of thing. The way to break hashed passwords is to use a precomputed rainbow table. That's typically a list of all possible passwords of a certain length range with the matching hashes. If you have that, cracking is easy, just a quick lookup.
Now, the problem with rainbow tables is that they are pretty big (starting with hundreds of GB's). That's big, but not that big these days. I
So the real question is how secure is SHA 1 then (Score:5, Interesting)
This would seem to raise two questions. the first is whether or not usernames can be tied to their corresponding hash. Even if they can't that's not a hugely difficult problem to overcome though.
The more serious question is how good is SHA 1 then. A database like this (a table of hashes) is what you'd expect someone could hack from a reasonably secure system (although you would have wanted to see some salting as well as hashing but either way). Having a hash of a password doesn't mean you can regenerate the password. If your password is subject to a simple dictionary attack then sure it can be regenerated, you're pretty much doomed, but you're not much more doomed than you were before. A strong password... now that's where this gets interesting. The question is whether or not there are vulnerabilities in SHA 1 that will let you regenerate good passwords (or even bad passwords that aren't dictionary attacks).
If you had a strong password, and SHA 1 is robust enough you could die of old age before anyone manages to figure it out. If SHA 1 has meaningful holes in it... well that's not so good.
Also, linkedin has 160 million users (or at least accounts) if not more than that. So their full database would be significantly larger than this. It will be interesting to know if this is a particular subset of the data (all iOS users, all android 2.3.2 users, all chrome users, that sort of thing) or something else. Purely hypothetically this could be all of the really early linked in users that haven't changed passwords since they implemented SHA 2 if they ever did for example, or it could be a particular version of the website fails.
People on twitter finding their password doesn't mean a whole lot, unless you know the password was strong and unique, and where those users are from, and when they joined linkedin.
Re: (Score:3)
Re: (Score:2)
ya but without any easy way to tie passwords to accounts there's nothing new there. Yes, lots of accounts on web services have bad passwords, that's not news to anyone.
Re: (Score:2)
Pseudo-code:
PasswordHash = SHA512(MergeArray(txtPassword.GetBytes(),Salt[]))
Where Salt[] is a Cryptographic.RNG.GetBytes(32), which is stored in the DB and generated new every time the password is set.
Re: (Score:2)
Nor should you.
That was my point with the blurb as to whether or not this might be a specific problem. Linkedin has been around since 2003, it's not inconceivable that they would have used SHA 1 in 2003, or in some countries for some circumstances etc.
Re: (Score:3)
The wonderful thing about having 6.5 million password hashes to play with is that a simple dictionary attack will probably get you a couple of million plaintext ones within hours. No need to look for weaknesses in SHA 1, just like there is no need for the cheetah to catch the gazelle at the front of the pack when there are plenty of easy pickings at the back.
Re: (Score:2)
Sure. But people with trivial passwords never had any hope of security anyway, we can discount those accounts and identities and write them off with or without this leak. It's everyone else I'd be worried about.
Re: (Score:2)
Right, but as I say, you could be dead before they can brute force it. Depends on how strong your password is and how much computing power can be thrown at it.
It's not going to be a big shock to hackers that there are a lot of people on linkedin with passwords like 12345678 and linkedin. Without any immediately obvious way to tie passwords to accounts they're not a whole lot better off. Using a simply dictionary attack to verify that yes, there are shitty passwords isn't really making those accounts much
Re: (Score:2)
'most' is a strong word here. If most people have terrible passwords there was never really anything you could do to save them and their accounts, especially if they reused those passwords.
The interesting part is the ones that won't show up in rainbow tables.
This is the famous iPad HTML5 app, right? (Score:2)
The LinkedIn iPad app is supposedly 95% HTML5 [venturebeat.com]. Makes me wonder how suitable it is as a "platform" handling sensitive data.
Analysis... (Score:2)
I don't know how LinkedIn's login APIs work, but if they use secure user/pass logins and store authentication tokens on the client side as is good practice then in theory exposing these server side generated hashes wouldn't really compromise the system. The problem is that SHA-1 has been broken :( So in theory someone could reverse these and get plaintext passwords and salts or whatever is in them.
This is one reason you don't send password hashes over the network...
Re:unique passwords for each website (Score:2)
And of course don't forget to store all your unique passwords that you have no hope of remembering in a plain-text file on your laptop and your smartphone, as well as on that piece of lined paper in the top drawer of your dresser.
Re: (Score:2)
And of course don't forget to store all your unique passwords that you have no hope of remembering in a plain-text file on your laptop and your smartphone, as well as on that piece of lined paper in the top drawer of your dresser.
This is either funny or sad, because probably a lot of people do exactly that. The blame belongs to the many sites with bad password policies or insecure password practices (including LinkedIn, apparently).
Here's the safer way to do it. Pick a passphrase of suitable length which you will remember, "QuintusFabiusMaximusCunctator" for example, then use that phrase to generate unique passwords by combining it with the site's web address. For instance, with LinkedIn, you'd have a password:
echo -n "Quintus
Re: (Score:2)
Or they can rainbow table for the string formed by [username + password]. Just prune off the values that don't start with the username. Usernames are typically made up of the same alphanumeric patterns as passwords, and aren't that long. It is better to use a random, large salt which has no patterns that can be exploited by future weaknesses discovered in the algorithm, and can be stored along with the hash. Adding a 500 byte random salt makes building a rainbow table just a little weeny bit harder... and
Gmail too (Score:2)
LinkedIn also takes contact information from your Gmail account: http://privacylog.blogspot.com/2008/12/privacy-fail-linkedin-steals-private.html [blogspot.com]
Nazi policies make cracking EASIER (Score:2)
i think a sane password policy would be
1 between 6 and 16 characters
2 case sensitive (but don't actually REQUIRE mixed case)
3 allow the full Latin-1 character set (with a limited number of excluded characters)
4 no dictionary words
5 encourage but don't require numbers and symbols
6 no reusing passwords
7 limit password changes to N a month (with further changes being done at the IT office).
but all these multi clause policies reduce the number of possible passwords (could somebody run the math on my suggestion
Re: (Score:2)
re 1, if users want a long (>16) passphrase, this is a good thing :)
re 4, I refer you to https://xkcd.com/936/ [xkcd.com]
ditch 6+7
add:
* client-side entropy check to reject cryptographically weak passwords
* server-side sanity check including (but not limited to) a quick dictionary+rainbow test
* option of pairing a CSPRNG authenticator (via mobile app or dedicated device)
* system's security has been vetted by people who actually know what the hell they're doing
As Yogi Berra would have said (Score:2)
Link me out
{ Actual quote: Include me out }
Information security standards? (Score:4, Insightful)
In cases like these, I feel like whoever is in charge of security over there needs to be held responsible for not following best practices and salting the damn password hashes. This has been security standard since PKCS #5 v2.0 [wikipedia.org] -- and you know security professionals don't publish these standards just for their own health. And this is not a new fangled thing, it was finalized in 2000 [ietf.org] 12 years ago.
Failure to do so is malpractice ...
Hashes list link (Score:5, Informative)
http://www.mediafire.com/?n307hutksjstow3
When checking for your password, check both for its SHA-1 hash and for the SHA-1 hash with the first five chars zeroed. Quoting [ycombinator.com]:
Some observations on this file:
...
0. This is a file of SHA1 hashes of short strings (i.e. passwords).
1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact.
Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters set to 0 is.
5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 is not present
000001e4c9b93f3f0682250b6cf8331b7ee68fd8 is present
Same story for 'secret':
e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4 is not present
00000a1ba31ecd1ae84f75caaa474f3a663f05f4 is present
And for 'linkedin':
7728240c80b6bfd450849405e8500d6d207783b6 is not present
0000040c80b6bfd450849405e8500d6d207783b6 is present
2. There are 2,936,840 hashes that do not start with 00000 that can be attacked with JtR.
3. The implication of #1 is that if checking for your password and you have a simple password then you need to check for the truncated hash.
4. This may well actually be from LinkedIn. Using the partial hashes (above) I find the hashes for passwords linkedin, LinkedIn, L1nked1n, l1nked1n, L1nk3d1n, l1nk3d1n, linkedinsecret, linkedinpassword,
5. The file does not contain duplicates. LinkedIn claims a user base of 161m. This file contains 6.4m unique password hashes. That's 25 users per hash. Given the large amount of password reuse and poor password choices it is not improbable that this is the complete password file. Evidence against that thesis is that password of one person that I've asked is not in the list.
Re: (Score:2)
Thanks for that info.
I checked the tail end of the SHA-1 hash of my LinkedIn password; it wasn't in the list, neither zeroed or in full. I'd already signed into LinkedIn and changed it, so it's moot, but yeah, my password wasn't in the dump.
Re: (Score:2)
Also, forgot to mention, isn't the implication of some cracked / some non cracked that whoever originally got their hands on the data only has the hashes, not the full passwords?
Of course, it's also possible that some scavenger started cracking the SHA-1 hashes in a file that someone else released...
Re: (Score:2)
My hash was on the list, in full. It was an old password, but a non-trivial long combination of (upper & lowercase) characters & numbers. Ouch!
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I don't know if you're expecting LinkedIn to comment, which I seriously doubt they will, but probably the same reason security shortcuts get taken everywhere. Laziness. Schedule pressure. Ignorance. Stubbornness. ("Damn SecurityGuy is always trying to make me more work! He's just paranoid. Nobody cracks SHA1!")
That's not an exhaustive list, obviously.
Re: (Score:3)
Looking at the list, I noticed the last 8 characeters didn't appear to be as random as they appear...
E.g., take your password hash and look above and below it...
you'll notice the last 8 characetrs seem to be lacking in entropy - 7ee6xxxx
This is true throughout the file - it looks to be a 32-bit counter of something, increasing in some fashion.
Re: (Score:3)
How to check for your password (single command) (Score:2)
If you're on a *nix system like Mac or Linux, you can check against the file (after downloading and unraring) with:
echo Type password and hit enter;stty -echo; read p; echo -n "$p" |shasum |cut -c6-40 |sed 's/$/$/' |grep -f- SHA1.txt; unset p; stty echo
If there is output, your password is probably exposed.
You can verify this methodology with any of the common passwords (like "password" sans quotes). Note that this isn't perfect; if it has a hit, it might have overlapped on the first five characters.
Re: (Score:3)
Just how many nails does the cloud's coffin take? (Score:3)
Just how many nails does this here cloud's coffin take ?
Legally mandated opening EULA clause:
"Your data is no longer private....".
These are not current password Hashs (Score:5, Informative)
Hash file here (Score:3, Informative)
So, if you have a Linked-in account, what now? (Score:2)
So, you can:
1) Change your Linked-in password. The security hole may not be fixed yet so you may just be handing them your newer password. Do it anyway with a throwaway password you use just for
Re:So, if you have a Linked-in account, what now? (Score:4, Informative)
You already know the answer. You just don't like it.
You say that using a different password for every site is not practical. Is it less practical than having to deal with Site A getting hacked and your bank account being emptied? For me, I'm perfectly willing to deal with the hassle of separate passwords.
What I'd suggest is that your "strong" category should all have distinct, strong passwords. I'm fond of 16+ random characters including numbers, caps, specials, etc. It's crazy to trust Amazon and eBay, both giant companies which big targets on their back filled with employees who may or may not be honest, with your bank password. Write 'em down if you have to. You can keep them in your wallet with no note about what they are or usernames, encrypted on your phone, whatever. If that's not good enough, lock them in a safe at home.
I do agree with having a throwaway class of password. I will reuse passwords across sites if they're sites I really don't care about. I don't really have a medium. If having it compromised would be bothersome, it gets its own password.
Re: (Score:2)
LinkedIn bashing? (Score:2)
This breach is looking very very bad. (Score:3, Insightful)
Wow, the LinkedIn hacking looks a lot worse as the hours roll by. There is no indication that the security breach has been fixed yet, so logging into LinkedIn to change your password might be futile - the hackers might still be in there and now they've got your new password too.
But thats not the worst, no not by a long shot. The 6.5 million password hashes that were uploaded to the Russian hacker forum are unique - i.e. any duplicate hashes are filtered out. Assuming some users pick the same "easy" passwords, it means the 6.5 million passwords could easily be a very significant chunk of the LinkedIn user base.
And lets take that a step further - until we know any better, we have to assume that the group who hacked LinkedIn and stole those passwords got away with at least your LinkedIn username too. Which is your email address. You didn't use the same password for your email account as you did for your LinkedIn account did you? Oh wait you did.. Better go change your email password too. This list of email addresses alone is very valuable to the dark side of the internet as it's a huge list of confirmed, valid emails addresses.
Its never great to be the bearer of bad news, but what was that - yes, that was it. LinkedIn also allows you to link your profile to your social media accounts - Facebook, Twitter, your private blog, etc etc. If you used the same email address and password to log into those accounts as you did for LinkedIn, you better get moving quick to change all of those passwords too (please, please use a different password for each site this time!) as at this point we have to assume the worst and that the hackers got the details about your linked profiles too.
For some users, your credit card information may have been stored too so you could "upgrade" your LinkedIn account. Oh and your profile probably has your address on it.
Finally, this opens up LinkedIn users to massive identity theft - generally LinkedIn users have uploaded their full CVs. That might even include your birthday and for married people your maiden name. It could easily show your first high school, where you went to college, the name of your first employer, etc etc. What are all those sort of details used for? Accessing your bank account, resetting passwords via security questions, you know, proving your identity online. Ouch.
This hack has potential to be bad. Really really bad. And until we know the size of the breach we have no idea how far reaching it could ultimately end up.
LinkedIn has just confirmed the breach (Score:4, Informative)
http://blog.linkedin.com/2012/06/06/linkedin-member-passwords-compromised/ [linkedin.com]
Re: (Score:3, Interesting)
Password changed and I don't use iOS. I'm all good... until next time. :P
Well, as long as the source of the leak is unknown, how do you know they cannot access your new password?
Re:Password changed (Score:4, Interesting)
So use different passwords for different sites.
Re: (Score:2)
Don't bother doing that with LinkedIn. Treat the account as if the password is not a secret and cannot be a secret, until LinkedIn fixes stuff.
Re: (Score:2)
Re: (Score:2)
Re: (Score:3)
I mean, seriously. This is something that has been known since, what, the time of Robert H. Morris?
Salt has to be added after it's hashed. Then it tasts better.
Re: (Score:2)
Re: (Score:2)
What you are describing is basically salted hashes. You have a salt that you add to the password before you hash it. Normally the same salt is used for every password. This sounds less secure than what you describe as an attacker could generate one hash dictionary to attack all of the hashes but only using one salt means that you don't need to store them in the d
Re: (Score:3)
Assuming otherwise allows you to do foolish things like use the same salt across multiple (or all) accounts. Which makes it trivial for an attacker to compute a single rainbow table and attack multiple accounts in one shot.
Having separate salts (at least 8-bit and preferably at least 16-bit or 32-bit) for every individual user gives you a last line of defense in the ev
Re: (Score:3)
Re: (Score:2)
Good link. The file seems legit. My hash is in there. Fucking Idiots at Linkedin.
Mine isn't, even omitting the first 5 digits. I'm changing it today anyway.
Luckily, that password is not used elsewhere. Nor will the new one be.