LinkedIn Password Hashes Leaked Online

It's not an exploit, it's a feature! by fuzzyfuzzyfungus · 2012-06-06 02:12 · Score: 5, Funny

Haven't you always wanted to forge closer ties with the dynamic marketing and legal-arbitrage entrepreneurs at the Russian Business Network? Now, LinkedIn is proud to announce your exciting, and mandatory, chance to do just that!

Re:It's not an exploit, it's a feature! by Soilworker · 2012-06-06 02:24 · Score: 2

But, where is the leaked list ?
Re:It's not an exploit, it's a feature! by Anonymous Coward · 2012-06-06 02:46 · Score: 1

How do you know the email originated from LinkedIn? Because it looked like it?
Re:It's not an exploit, it's a feature! by SternisheFan · 2012-06-06 03:37 · Score: 5, Interesting

I applied for a job earlier this year, and the pool company rejected my 'text format' resume, insisting on a resume submitted via Linked In. The last thing I wanted to do was have to join some social network just to get a job. I lived 10 minutes away from the home.office of the job and offered to meet to interview and hand them a hard copy resume. No dice, it had to be done by this Linked In. Now, after reading this news, I know it was the right decision. This internet sure has gotten wacky.
Re:It's not an exploit, it's a feature! by Relayman · 2012-06-06 05:09 · Score: 4, Interesting

Ironically, LinkedIn could have put you in contact with someone who could have bypassed HR all together. That's what networking is all about. It's a tool and if you insist on using a hammer instead of a screwdriver, good luck to you.

--
If I used a sig over again, would anyone notice?
Re:It's not an exploit, it's a feature! by jforr · 2012-06-06 08:33 · Score: 2

I applied for a job earlier this year, and the pool company rejected my 'text format' resume, insisting on a resume submitted via Linked In. The last thing I wanted to do was have to join some social network just to get a job. I lived 10 minutes away from the home.office of the job and offered to meet to interview and hand them a hard copy resume. No dice, it had to be done by this Linked In.
Now, after reading this news, I know it was the right decision.
This internet sure has gotten wacky.
I've noticed this as a growing trend. Generally the reasoning behind such things is people are far less likely to outright lie on a linkedin profile where former co-workers and classmates will also see it than on a resume that is only read by a hiring manager and HR.
Re:It's not an exploit, it's a feature! by RockDoctor · 2012-06-07 11:29 · Score: 1

Generally the reasoning behind such things is people are far less likely to outright lie on a linkedin profile where former co-workers and classmates will also see it than on a resume that is only read by a hiring manager and HR.
That is reasonable reasoning. If someone put that explanation to me when saying why they wanted a $NETWORK$ formatted submission, then I'd be pretty happy to comply. If I had an existing account on $NETWORK$ and a few other quibbles.

--
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"

Plain text by Anonymous Coward · 2012-06-06 02:15 · Score: 5, Funny

This sort of vulnerability is exactly why I avoid storing passwords in hash form. I always store passwords in plain text form. It's much more secure.

Re:Plain text by fuzzyfuzzyfungus · 2012-06-06 02:21 · Score: 4, Funny

This sort of vulnerability is exactly why I avoid storing passwords in hash form. I always store passwords in plain text form. It's much more secure.
Y'know what fools the black-hats every time? Store the passwords in plaintext; but require all users to create a password consisting of exactly 64 hexadecimal characters... Even better, we all know that users hate security, so more user hatred = more secure. And this system is Super Secure.
Re:Plain text by vlm · 2012-06-06 02:26 · Score: 4, Funny

Won't work, local policy prevents repeated numbers, and letters must be a mix of upper and lower case, and no sequential numbers. (I only wish I were kidding)

--
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Re:Plain text by Whalou · 2012-06-06 02:31 · Score: 2

Or require users to create a password that when hashed makes a readable sentence.

--
English is not this .sig mother tongue...
Re:Plain text by NatasRevol · 2012-06-06 02:34 · Score: 4, Interesting

That's nothing.
http://kottke.org/12/06/the-worlds-worst-password-requirements-list

--
There are two types of people in the world: Those who crave closure
Re:Plain text by Ken+D · 2012-06-06 02:38 · Score: 1

And no numbers that could be letter substitutes.
So no 0,1,2,3,4,5,6,7,8 or 9 is allowed. You must include numbers not in this set. (Also please remember that NaN is not a number and thus does not satisfy the numeric requirement).
Re:Plain text by michelcolman · 2012-06-06 03:07 · Score: 3, Funny

The password "Password" is not allowed, but "pissword" is because it contains a number!
Re:Plain text by sudonymous · 2012-06-06 03:07 · Score: 1

Actually, NaN IS a number... a number that claims it's not a number!
< typeof NaN > "number"
Also, is anyone else suddenly aware of how dumb the word "number" is? "number".
Re:Plain text by ArhcAngel · 2012-06-06 04:29 · Score: 3, Insightful

I love that. The entity is basically telling thieves what target vectors to use when configuring their attack bots.

i.e. Only attempt passwords with 6 to 8 characters and filter out any where # of capitol letters is < 1 or > 1 and # of numbers !=2. I'm sure it's still a large sample but infinitesimally smaller than just requiring a password to be more than 6 characters.

--
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
Re:Plain text by RCL · 2012-06-06 04:29 · Score: 4, Funny

That's nothing: this is the real ubersecure requirement.

--
Coding etudes
Re:Plain text by DriedClexler · 2012-06-06 04:58 · Score: 4, Informative

Considering that LinkedIn was storing the passwords unsalted, it's really not much better than plaintext.
The only question at this point is whether their "security" team suffers from mild, or severe learning disabilities.

--
Information theory is life. The rest is just the KL divergence.
Re:Plain text by Relayman · 2012-06-06 05:11 · Score: 1

Furthermore, the security of his password is only as good as the security in India. I'm not saying that India is not secure...

--
If I used a sig over again, would anyone notice?
Re:Plain text by Culture20 · 2012-06-06 07:29 · Score: 1

is anyone else suddenly aware of how dumb the word "number" is? "number".
I have become numb to the meaning, and am only getting number and number.
Re:Plain text by eulernet · 2012-06-06 09:20 · Score: 1

It could be worse: they could force users to change their password every month !
Re:Plain text by mgcarley · 2012-06-06 10:32 · Score: 1

It's really not. Except when you need to do something useful. The use of digital certificates is fairly common for some forms of government interaction BUT the certificate can only be used on the computer it was generated on. So, if you change law firms/accountants OR if the computer they used dies, you're SOL and have to buy a new cert (or something to that effect).

--
Founder & COO, Hayai India (hayai.in) / USA (hayaibroadband.com) // t: @mgcarley
Re:Plain text by rollingcalf · 2012-06-06 11:21 · Score: 1

Unsalted SHA-1 hashing is still a lot better than plaintext. Unsalted passwords won't be found by a rainbow table or dictionary attack if they're long enough and complex enough. Even 12 characters with a mix of letters and numbers and symbols, and without any dictionary words, will defeat just about any rainbow table or dictionary attack on SHA-1 hashes.
Extended brute force attacks may reveal some of the longer passwords, but that's a much bigger and time-consuming task than rainbow table and dictionary attacks. They won't have the time and computing resources to successfully attack even 1% of the longer passwords in that manner.

--
---------
There is inferior bacteria on the interior of your posterior.
Re:Plain text by Vintermann · 2012-06-07 00:43 · Score: 1

passwordNaN is not in the dump. We can conclude that appending an IEEE float to even a very bad password makes it secure.

--
xkcd is not in the sudoers file. This incident will be reported.
Re:Plain text by DMUTPeregrine · 2012-06-07 11:53 · Score: 1

SHA-1 has an actual better-than-brute-force collision discovery attack. Since 2005.

--
Not a sentence!
Re:Plain text by rollingcalf · 2012-06-07 15:39 · Score: 1

But that is only for generating collisions, not pre-image attacks where they find a plaintext that hashes into a specified result.

--
---------
There is inferior bacteria on the interior of your posterior.
Re:Plain text by unreadepitaph · 2012-06-11 16:54 · Score: 1

I bank with Suncorp and the only way you can move money out of your accounts is with an extra password that's provided by the bank or an RSA token.
I'm not saying that the password is secure, but that it's not the most important part of securing themselves against fraud.
They'd rather give the majority of users a better experience on their system and let the people who need to move money have a secondary requirement that prevents fraud.

--
My internetting is no good.

Good! by OakDragon · 2012-06-06 02:15 · Score: 5, Funny

Maybe I can find mine, I can't remember it!

--
Dark Reflection

Re:Good! by Anonymous Coward · 2012-06-06 08:31 · Score: 1

5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
You're welcome!

Could someone please look up my password for me? by vlm · 2012-06-06 02:18 · Score: 1

I haven't logged into linkedin for so long, that I don't remember my password anymore.
And I blocked emails from *@linkedin.com as spam, because, well, they're basically all spam. I can't be bothered to unblock and do email based password recovery.
Could some Russian friend please look up my password for me, and reply back?
K thx bye

--
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger

SALT YOUR HASHES! by Anonymous Coward · 2012-06-06 02:18 · Score: 1

I mean, seriously. This is something that has been known since, what, the time of Robert H. Morris?

Re:SALT YOUR HASHES! by rvw · 2012-06-06 03:22 · Score: 2

I mean, seriously. This is something that has been known since, what, the time of Robert H. Morris?
Salt has to be added after it's hashed. Then it tasts better.
Re:SALT YOUR HASHES! by HexaByte · 2012-06-06 09:33 · Score: 1

I'm sorry, I'm on a salt restricted diet. Can we use lite salt or just come pepper?

--
HexaByte - he's a square and a half!
Re:SALT YOUR HASHES! by Vintermann · 2012-06-07 00:57 · Score: 1

What surprises me almost as much as Linkedin not salting their passwords, is Linkedin rolling their own password authentication system. I'm not really a web developer myself, but shouldn't they have standard (and well-tested) modules and libraries for this sort of stuff?

--
xkcd is not in the sudoers file. This incident will be reported.
Re:SALT YOUR HASHES! by datavirtue · 2012-06-07 05:52 · Score: 1

Peter Piper picked a hash of pickled and peppered passwords.

--
I object to power without constructive purpose. --Spock

So what? by liquidweaver · 2012-06-06 02:19 · Score: 1

What are you going to do with millions of password hashes, even without usernames none the less?

--
mov ah, 4ch
int 21h

Re:So what? by DocSavage64109 · 2012-06-06 02:23 · Score: 5, Insightful

If he has the password hash, then he most likely also has the username. He just didn't share them with the rest of the world and is likely trying to sell them.
Re:So what? by vlm · 2012-06-06 02:40 · Score: 1

What are you going to do with millions of password hashes, even without usernames none the less?
I've occasionally daydreamed a fun academic paper would be to collect sets of password hashes, rub them up against a rainbow table, and make graphs and correlations and wild assumptions about the correlation coeff of IQ and rate of easily cracked pwd vs site etc etc. Sounds like fun so its probably been done before.

--
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Re:So what? by cryptizard · 2012-06-06 02:54 · Score: 5, Insightful

People use these kinds of leaks to generate statistically sorted dictionary files for password breaking. The most commonly used (in the real world, as evidenced by these leaked databases) passwords are put at the front so you try all the more likely ones before moving on to the random guessing.
Re:So what? by cryptizard · 2012-06-06 02:55 · Score: 2

Replying to myself, in this case you can only get information about passwords that you are actually able to break (i.e. the easy ones), but it can also be useful as an academic analysis of password complexity in real applications.
Re:So what? by chill · 2012-06-06 03:02 · Score: 2

LinkedIn uses e-mail addresses as usernames. Getting access to a crapload of valid e-mail addresses to test against is trivial.

--
Learning HOW to think is more important than learning WHAT to think.
Re:So what? by Diomidis+Spinellis · 2012-06-06 04:06 · Score: 4, Informative

I've occasionally daydreamed a fun academic paper would be to collect sets of password hashes, rub them up against a rainbow table, and make graphs and correlations and wild assumptions about the correlation coeff of IQ and rate of easily cracked pwd vs site etc etc. Sounds like fun so its probably been done before.
Yes, it's been done on 70 million passwords. See http://www.cl.cam.ac.uk/~jcb82/doc/B12-IEEESP-analyzing_70M_anonymized_passwords.pdf
Re:So what? by tgd · 2012-06-06 05:24 · Score: 1

What are you going to do with millions of password hashes, even without usernames none the less?
How do you suppose all the people mentioned on Twitter who verified their passwords in the list were correct did so if they couldn't find their hash in the list?
Of bigger concern to me is not the loss of the passwords, but the loss of the e-mail addresses (usernames). That's a VERY long list of valid, valuable e-mail accounts.
Re:So what? by liquidweaver · 2012-06-06 05:58 · Score: 1

Question - how do you get passwords back from one-way hashes, given that each hash can be generated from an infininate number of original values?

--
mov ah, 4ch
int 21h
Re:So what? by tibman · 2012-06-06 06:26 · Score: 2

You generate hashes until you match the target hash. It's possible that your original value is different than the actual password. But they hash the same so it doesn't matter : )

--
http://soylentnews.org/~tibman
Re:So what? by cryptizard · 2012-06-06 06:40 · Score: 1

As others have said, you just generate strings until you get one that matches the hash. It is possible that the string you generated does not match the original password, but if you are generating "reasonable" passwords then that probability is so small as to be negligible. For instance, if the hashes are 128-bits and you are trying all alphanumeric passwords up to 10 digits (upper and lower case) then you have less than 2^60 combinations. The probability that you find a collision with the target hash that is not the actual password used is 1/2^(128-60) = 2^-68 i.e. infinitesimally small. If the password space you are checking is very large (somewhere in the range of 20 digit case-sensitive alphanumeric plus symbols) then the probability that you have found a password that hashes but was not the user's password becomes non-negligible.
Re:So what? by Midnight_Falcon · 2012-06-06 06:50 · Score: 2

"Rainbow Tables" attack: https://en.wikipedia.org/wiki/Rainbow_tables
Re:So what? by WuphonsReach · 2012-06-06 06:55 · Score: 2

If the site uses a single salt for all passwords, then as soon as you crack user A's password, you have user X, Y & Z passwords because they have the same account hash. (In fact, you would specifically target any hashes which appear more then once.)

The initial break of the hash is either done via a pre-gen rainbow table (which contains pairs of passwords and their hashes) or by brute-force approach (work through possible passwords, hash them, compare against the list of hashes, spit out the matches).

Also, since you have the hashes, and checking random passwords against the hashes is an embarrassingly parallel problem you can throw as many cores, machines, GPUs at the problem as you want. That lets you try millions of passwords per second. Which is fast enough that you can go through all 8-character passwords plus more advanced schemes like word-word-number-symbol.

--
Wolde you bothe eate your cake, and have your cake?
Re:So what? by jittles · 2012-06-06 08:26 · Score: 1

About a month or two ago, my brother's email account was taken over. The account is on a private domain that no one has ever heard of. Its only used for family email. Turns out he used that account to create his linked in account. I wouldn't be surprised if that is how they managed to compromise his (mostly) unused email account.
Re:So what? by liquidweaver · 2012-06-06 09:50 · Score: 1

Ah yes - the hash is the same. That's the part that matters!

--
mov ah, 4ch
int 21h
Re:So what? by Vintermann · 2012-06-07 01:00 · Score: 1

Little Rainbow Tables, we call him.

--
xkcd is not in the sudoers file. This incident will be reported.
Re:So what? by datavirtue · 2012-06-07 05:55 · Score: 1

and if you find numerous hashes that are the same and are able to crack it, you then have the password for all of those accounts.

--
I object to power without constructive purpose. --Spock
Re:So what? by RalphTheWonderLlama · 2012-06-07 06:28 · Score: 1

That's why it's bigger in the past

--
simple, fast homepage with your links: http://www.ngumbi.com/

Colour me surprised! by rogueippacket · 2012-06-06 02:19 · Score: 5, Interesting

If you install any app on your mobile device - especially those which thrive off of your data - don't be surprised if it's actually siphoning it off in the background. If groups like Facebook and LinkedIn simply wanted you to access the service remotely, they would just stick to HTML5. Instead, apps give them unfettered access to your contacts, calendar, location, and everything else on your personal device, regardless of platform.
Just remember, it has never been about convenience to the user, and always profitability to the provider.

Re:Colour me surprised! by fuzzyfuzzyfungus · 2012-06-06 02:27 · Score: 4, Insightful

The surprising thing is not that Social 2.0 Mobile Enterprise BuzzCloud App-centric bullshit is shoving everything that it can get its sticky little fingers on to every 3rd party with questionable security and a dire privacy policy that it can find; but that they seem to be so incompetent at it.

Exfiltrating the data in the clear is certainly easy enough(luckily 'mobile' frequently means 'even if I were competent enough, my crypto-crippled appliance wouldn't let me control outbound traffic anyway') but it makes it likely that, sooner or later, somebody is going to sniff some packets at their router and we'll get a little story about exactly how much exfiltration your ghastly little app is doing.

It's like corruption. Even when everybody knows that it is happening, it is still considered crass to get caught with your hand in the cookie jar. You are supposed to pretend to care.
Re:Colour me surprised! by DogDude · 2012-06-06 02:39 · Score: 1

Android and Apple phones do that. Windows phones keep the apps sandboxed.

--
I don't respond to AC's.
Re:Colour me surprised! by markkezner · 2012-06-06 03:06 · Score: 1

Android and iOS both have permissions and protections in place to prevent apps from accessing personal data such as Contacts and Location. Although there have been incidents of breaches, the protections work most of the time. Android also sandboxes the apps, and although I'm not 100% sure I believe that iOS does so as well.
What is it about the Windows Phone implementation specifically that is so different and presumably better?

--
Dangerous, sexy, turing complete: Femme Bots
Re:Colour me surprised! by TemporalBeing · 2012-06-06 04:22 · Score: 1

Android and iOS both have permissions and protections in place to prevent apps from accessing personal data such as Contacts and Location. Although there have been incidents of breaches, the protections work most of the time. Android also sandboxes the apps, and although I'm not 100% sure I believe that iOS does so as well.
What is it about the Windows Phone implementation specifically that is so different and presumably better?
And for Android the user has to give permission for the app to be able to do things like access the Contacts, SD Card, and such - any inter-app communication must be approved by the user when the app is installed. Too often, people don't pay attention to what they are granting though.

--
Truth is like the sun. You can shut it out for a time, but it ain't goin' away. - Elvis Presley (source: imdb.com)
Re:Colour me surprised! by Bogtha · 2012-06-06 05:15 · Score: 2

If groups like Facebook and LinkedIn simply wanted you to access the service remotely, they would just stick to HTML5.

That's a ridiculous thing to say. There are a lot of factors that go into deciding between a native and a mobile web app, and it certainly doesn't simply boil down to "they want to steal your data".

apps give them unfettered access to your contacts, calendar, location, and everything else on your personal device, regardless of platform.

Again, you don't know what you are talking about. Android has a fine-grained permission system, not all applications have access to these things. On iOS, accessing the person's location prompts the user and Apple are expanding this to contacts as well.

Just remember, it has never been about convenience to the user, and always profitability to the provider.

That's funny, I've worked on several apps that simply wouldn't work at all as mobile web apps (e.g. offline access to gigabytes of data) and almost all of the decisions to go with a native application I am aware of were made with regard to functionality and user experience.

--
Bogtha Bogtha Bogtha
Re:Colour me surprised! by andymadigan · 2012-06-06 17:57 · Score: 1

They need to replace "this app requires these permissions" with "pick the permissions you'd like to grant this app".

The phone then provides false responses to attempts to call non-permitted APIs. The user can also be prompted the first time the app tries to use the permission. Apps which try to exit when not granted enough permissions (instead of degrading gracefully) would be quickly removed from the official market.

"Security (and Privacy) through Dissembly"

--
The right to protest the State is more sacred than the State.
Re:Colour me surprised! by DMUTPeregrine · 2012-06-07 11:57 · Score: 1

Also, for Android users on custom ROMS:
Gingerbread:
http://forum.xda-developers.com/showthread.php?t=1357056
And for ICS:
http://forum.xda-developers.com/showthread.php?t=1554960

--
Not a sentence!

Re:Password changed by Anonymous Coward · 2012-06-06 02:19 · Score: 3, Interesting

Password changed and I don't use iOS. I'm all good... until next time. :P

Well, as long as the source of the leak is unknown, how do you know they cannot access your new password?

Re:Could someone please look up my password for me by Anonymous Coward · 2012-06-06 02:23 · Score: 5, Funny

Greetings comrade,
Try the following password: 12345
Sincerely Boris

A New Euphemism! by Rob+Riggs · 2012-06-06 02:24 · Score: 5, Funny

"Harvested" -- I love it!

"Bernie Madoff harvested money from his investors."

"H.I. harvested diapers from the convenience store."

"LinkedIn harvested private data from my phone."

They're doing you a favor by "harvesting". Because it's not doing anyone any good if it remains "unharvested".

--
the growth in cynicism and rebellion has not been without cause

Re:A New Euphemism! by Anonymous Coward · 2012-06-06 02:41 · Score: 2, Informative

harvest
[hahr-vist] Show IPA
noun
1. Also, harvesting. the gathering of crops.
2. the season when ripened crops are gathered.
3. a crop or yield of one growing season.
4. a supply of anything gathered at maturity and stored: a harvest of wheat.
5. the result or consequence of any act, process, or event: The journey yielded a harvest of wonderful memories.
verb (used with object)
6. to gather (a crop or the like); reap.
7. to gather the crop from: to harvest the fields.
8. to gain, win, acquire, or use (a prize, product, or result of any past act, process, plan, etc.).
9. to catch, take, or remove for use: Fishermen harvested hundreds of salmon from the river.
Re:A New Euphemism! by Ksevio · 2012-06-06 03:37 · Score: 2

You can also use "leaked" in the reverse sense!
"Investors leaked money to Bernie Madoff"
"The convenience store leaked diapers to H.I."
"My phone leaked private data to LinkedIn"
Re:A New Euphemism! by tringstad · 2012-06-06 04:34 · Score: 2

What are you suggesting it is a euphemism for?
We can't call it stealing while simultaneously taking the stance that copying MP3s (or any other data) isn't stealing because the original data has not been lost to the original owner.

--
"I got a half gallon of Jack, and 2 dozen Ant Traps. I'm about to get wild." -me
Re:A New Euphemism! by styrotech · 2012-06-06 13:10 · Score: 1

H.I. harvested diapers from the convenience store.
"I'll be taking these huggies and whatever cash you got."
On the other hand, there's no harvesting to be done in rocky places where seed could find no purchase.

broken glass all over the road by Anonymous Coward · 2012-06-06 02:25 · Score: 5, Insightful

As an IT/security guy reading about these seemingly constant ongoing password change requests, I can't help but think that the problem lies not only with how many special characters we're using in our passwords, or whether or not we're using our pet's name, but more so in how the infrastructures of all of these magically eutopian social networks are storing this information. Correct me if I am wrong, but haven't the majority of the recent problems that have forced us all to change our passwords, whether it is LinkedIn, World of Warcraft or whatever been due to leaks from the back-end, not poor Johnny at the keyboard giving it to Ivan the hacker (no offense to the real Ivans or Johnnys)? Kind of like having to keep replacing the car tires because the roads are made of broken glass. Its not my fault, but I have to suffer. It would seem we need to put more PCI/SOX/whatever-like standards in place to better protect and mandate how our information is stored as more and more encouragement is put in place to unzip our metaphorical zippers online.

And for the record, I am not an anonymous coward, but I forgot my password and my email isn't the same as it was 8+ years ago when I set up my slashdot account...

ignorance is bliss in this case :)

Re:broken glass all over the road by fuzzyfuzzyfungus · 2012-06-06 02:29 · Score: 4, Insightful

Are you suggesting that power should be accompanied by responsibility?

Why do you hate America, you godless communist?
Re:broken glass all over the road by AbRASiON · 2012-06-06 03:23 · Score: 1

I really hate to link xkcd but they are on the money with this one.
http://xkcd.com/936/
I'm getting tired of having to have ridiculous passwords, now I'm just either ALWAYS making the first character an uppercase because it's easier, or doing quick pattern based passwords for the ultra fussy systems.
123qwe!@#QWE - that's surprisingly quick to input yet keeps those stupid systems quiet.
Re:broken glass all over the road by Xenna · 2012-06-06 06:18 · Score: 1

No, it's a good idea to force users to have different types of characters in their passwords. That's exactly because of this kind of thing. The way to break hashed passwords is to use a precomputed rainbow table. That's typically a list of all possible passwords of a certain length range with the matching hashes. If you have that, cracking is easy, just a quick lookup.
Now, the problem with rainbow tables is that they are pretty big (starting with hundreds of GB's). That's big, but not that big these days. If users limit themselves to lower case alfa characters you have a pretty manageable diamond table. But if you have to account for punctuation marks, numbers and upper case characters their size explodes.
But thats still not good enough. Anyone worth their salt uses a salt. A random string of characters that you store with the password that's used to seed the hash with. A long enough salt makes using rainbow tables impossible because the space required to store them would be humongous. In an application of mine I have also added a system wide salt that is not stored in the database. If anyone gets their hands on the database data, but not the code, they'll have an extra problem to figure out.
So you're back to brute forcing, which is going to take you a very long time with 6 million passwords.
Unfortunately for the LinkedIn people, someone forgot their salt, so the passwords can be cracked fairly easily if someone has the required rainbow table.
Re:broken glass all over the road by HexaByte · 2012-06-06 10:03 · Score: 1

Hate America? What are you talking about? Only in America can we get rich off of the coming class action lawsuit because of this!

--
HexaByte - he's a square and a half!
Re:broken glass all over the road by Vintermann · 2012-06-07 01:09 · Score: 1

123qwe!@#QWE
Just to inform you, that password was in the dump (or at least, in the file I downloaded that claimed to be the dump).
$ echo -n '123qwe!@#QWE' | sha1sum cc2afe5029cf4ae9189c91d7454c7671a6612078 *-
Just for fun, I googled that hash.

--
xkcd is not in the sudoers file. This incident will be reported.
Re:broken glass all over the road by AbRASiON · 2012-06-07 01:14 · Score: 1

Surely though the way linked in was storing the data means most passwords would be compromised (I have no crytpto knowledge)
For the most part a 12 digit password with that combination should surely be fairly good.
The more important thing though (for me) is the convienience of how quick it can be input.
Re:broken glass all over the road by Vintermann · 2012-06-07 02:18 · Score: 1

Nope, if you password was strong (say, like the one an anonymous coward posted below: GiwwEeEaT520) it would not have been broken. The likes of qwe123QWE!"# may fool password policies, but they're very, very common and crackers know it.

--
xkcd is not in the sudoers file. This incident will be reported.
Re:broken glass all over the road by AbRASiON · 2012-06-07 02:33 · Score: 1

This is making the xkcd post even more relevant then :/ frustrating.

Re:Could someone please look up my password for me by vlm · 2012-06-06 02:28 · Score: 4, Funny

Thank you Boris, but that is my luggage combination, not my linkedin password.
Admittedly my luggage is more important to me than my linkedin account, but...

--
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger

So the real question is how secure is SHA 1 then by Sir_Sri · 2012-06-06 02:28 · Score: 4, Interesting

This would seem to raise two questions. the first is whether or not usernames can be tied to their corresponding hash. Even if they can't that's not a hugely difficult problem to overcome though.

The more serious question is how good is SHA 1 then. A database like this (a table of hashes) is what you'd expect someone could hack from a reasonably secure system (although you would have wanted to see some salting as well as hashing but either way). Having a hash of a password doesn't mean you can regenerate the password. If your password is subject to a simple dictionary attack then sure it can be regenerated, you're pretty much doomed, but you're not much more doomed than you were before. A strong password... now that's where this gets interesting. The question is whether or not there are vulnerabilities in SHA 1 that will let you regenerate good passwords (or even bad passwords that aren't dictionary attacks).

If you had a strong password, and SHA 1 is robust enough you could die of old age before anyone manages to figure it out. If SHA 1 has meaningful holes in it... well that's not so good.

Also, linkedin has 160 million users (or at least accounts) if not more than that. So their full database would be significantly larger than this. It will be interesting to know if this is a particular subset of the data (all iOS users, all android 2.3.2 users, all chrome users, that sort of thing) or something else. Purely hypothetically this could be all of the really early linked in users that haven't changed passwords since they implemented SHA 2 if they ever did for example, or it could be a particular version of the website fails.

People on twitter finding their password doesn't mean a whole lot, unless you know the password was strong and unique, and where those users are from, and when they joined linkedin.

Database itself by Anonymous Coward · 2012-06-06 02:30 · Score: 1

For the moment, you can get the database here:

https://disk.yandex.net/disk/public/?hash=pCAcIfV7wxXCL/YPhObEEH5u5PKPlp%2BmuGtgOEptAS4%3D

Surely it will soon find its way into other filesharing sites and torrents, if they take it down from above.

Re:Database itself by DynamoJoe · 2012-06-06 03:48 · Score: 2

Good link. The file seems legit. My hash is in there. Fucking Idiots at Linkedin.

--
bah.
Re:Database itself by AliasMarlowe · 2012-06-06 04:55 · Score: 1

Good link. The file seems legit. My hash is in there. Fucking Idiots at Linkedin.
Mine isn't, even omitting the first 5 digits. I'm changing it today anyway.
Luckily, that password is not used elsewhere. Nor will the new one be.

--
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
Re:Database itself by shutdown+-p+now · 2012-06-06 06:52 · Score: 1

Some of the hashes in that database seem to have the first few digits overwritten in zeros. Try looking not for the entire hash of your password, but for the last couple of digits.

This is the famous iPad HTML5 app, right? by Lisandro · 2012-06-06 02:32 · Score: 1

The LinkedIn iPad app is supposedly 95% HTML5. Makes me wonder how suitable it is as a "platform" handling sensitive data.

Re:This is the famous iPad HTML5 app, right? by shutdown+-p+now · 2012-06-06 06:55 · Score: 1

This has nothing to do with technology used, and everything with idiotic security practices (either they passed hashes over the wire unsecured, or their servers are compromised - the latter being far more likely).

Comment removed by account_deleted · 2012-06-06 02:32 · Score: 2

Comment removed based on user account deletion

Analysis... by patniemeyer · 2012-06-06 02:33 · Score: 1

I don't know how LinkedIn's login APIs work, but if they use secure user/pass logins and store authentication tokens on the client side as is good practice then in theory exposing these server side generated hashes wouldn't really compromise the system. The problem is that SHA-1 has been broken :( So in theory someone could reverse these and get plaintext passwords and salts or whatever is in them.

This is one reason you don't send password hashes over the network...

Re:Analysis... by Anonymous Coward · 2012-06-06 03:17 · Score: 1

Salting. Look, here's what salting does for you. Suppose you have an unsalted password. You can generate a rainbow table like this:
Imagine that the maximum length of the password is l characters, and that there are 95 characters that are permissible in passwords
rainbow = dict() for every i in range(l**95): rainbow.add(i,hash(i))
Without a salt, you can use one rainbow table as a dictionary for any password to hash combination.
If you salt with the username, even if you interpret Kerckhoffs' principle as meaning that the attacker knows the userlist (if, e.g., they have the passwd file), now the attacker has to do this:
userlist = [username1,username2,username3,...] rainbow = dict() for every username in userlist: for every i in range(l**95): rainbow.add(i,hash(username+i))
In other words, Eve/Evan still has to build a rainbow table FOR EACH KNOWN SALT VALUE.
Re:Analysis... by jkflying · 2012-06-06 05:30 · Score: 1

Or they can rainbow table for the string formed by [username + password]. Just prune off the values that don't start with the username. Usernames are typically made up of the same alphanumeric patterns as passwords, and aren't that long. It is better to use a random, large salt which has no patterns that can be exploited by future weaknesses discovered in the algorithm, and can be stored along with the hash. Adding a 500 byte random salt makes building a rainbow table just a little weeny bit harder... and if you aren't interested in storing an extra 1/2 a KB as a measure to keep your client's passwords safe, you should probably re-evaluate your priorities.

--
Help I am stuck in a signature factory!
Re:Analysis... by thogard · 2012-06-06 15:29 · Score: 1

There are two common ways of building rainbow tables.
1) Start with a list of common passwords and fill in entries as you go along and then use an algorithm like john the ripper. This produces a mostly useful table sooner than the other option.
2) Try everything. If you try everything you can rewind the hash as you fiddle with the last character. It saves lots of time. If you've got a parallel system, you can move the pre-compute block around and do all 256 bytes at once, store the results and go back one byte, increment and do it all over again. You can create a massive amount of hashes very quickly. I think this is on about the order of 2^32 faster than the 1st method based on todays cheap hardware.
Remember that the purpose isn't to get all the passwords, just some. If your seeds are known (and they have to be by something), then you can build tables for just the most popular seeds. It takes just as long to create a non-seeded rainbow table as it does to create a table for one seed.
I wonder if it doesn't make sense to split the seed so half is at the front and half at the end. It has the advantage of blowing out the compute time for rainbow tables for a given seed size. Of course bigger seeds are good too.
Re:Analysis... by Vintermann · 2012-06-07 01:30 · Score: 1

You are woefully misinformed. No, SHA has not been broken nearly that badly. They've managed to generate some collisions with a birthday attack, but that's a far cry from reversing a hash.
And yes, leaking the hashes this way is bad, and it IS the problem. Especially when they aren't salted, which is just a security WTF.

--
xkcd is not in the sudoers file. This incident will be reported.

Re:Could someone please look up my password for me by equex · 2012-06-06 02:36 · Score: 2

i can only see ******

--
Can I light a sig ?

Re:Could someone please look up my password for me by vlm · 2012-06-06 02:37 · Score: 1

Just like Shakespeare is better when read in the original klingon, thats funnier in the original TDWTF ... the password is hunter fourty two pound... No not the octothorpe sign, pound sign!

--
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger

Gmail too by fulldecent · 2012-06-06 02:38 · Score: 1

LinkedIn also takes contact information from your Gmail account: http://privacylog.blogspot.com/2008/12/privacy-fail-linkedin-steals-private.html

--

-- I was raised on the command line, bitch

Re:Could someone please look up my password for me by Anonymous Coward · 2012-06-06 02:43 · Score: 1

Sorry comrade,
Password file is big...
Have you tried rebooting your luggage?
Sincerely Boris

Re:So the real question is how secure is SHA 1 the by jrumney · 2012-06-06 02:44 · Score: 2

How strong strong passwords are doesn't really matter. Enough people on linkedin will have weak passwords that spammers will be queuing up to get their hands on a new "trusted" delivery mechanism for their wares.

Nazi policies make cracking EASIER by RobertLTux · 2012-06-06 02:55 · Score: 1

i think a sane password policy would be

1 between 6 and 16 characters
2 case sensitive (but don't actually REQUIRE mixed case)
3 allow the full Latin-1 character set (with a limited number of excluded characters)
4 no dictionary words
5 encourage but don't require numbers and symbols
6 no reusing passwords
7 limit password changes to N a month (with further changes being done at the IT office).

but all these multi clause policies reduce the number of possible passwords (could somebody run the math on my suggestion and the most common Nazi set??)

--
Any person using FTFY or editing my postings agrees to a US$50.00 charge

Re:Nazi policies make cracking EASIER by Infernal+Device · 2012-06-06 03:05 · Score: 1

And then your users will all use 'password1', 'password2', 'password3' or some variant thereof every time they change their password, IF they change their password.
Unfortunately, sometimes that's just what you get stuck with.

--
"My God...it's full of trolls!"
Re:Nazi policies make cracking EASIER by Sabriel · 2012-06-06 04:49 · Score: 1

re 1, if users want a long (>16) passphrase, this is a good thing
re 4, I refer you to https://xkcd.com/936/
ditch 6+7
add:
* client-side entropy check to reject cryptographically weak passwords
* server-side sanity check including (but not limited to) a quick dictionary+rainbow test
* option of pairing a CSPRNG authenticator (via mobile app or dedicated device)
* system's security has been vetted by people who actually know what the hell they're doing :)
Re:Nazi policies make cracking EASIER by sudonymous · 2012-06-06 05:00 · Score: 1

That would be lovely. I for one would welcome a login roadblock from my security overlord which read to the effect of, "We periodically test the strength of our user's passwords by running automated checks. These methods are similar to what an attacker might do if they gained access to our password database. We value our customers and want to ensure that we provide you the highest level of safety. Your password was flagged as being too weak, and you must change it before continuing to log in. Please verify that your session is secure (blue icon in the address bar and https: before the URL), then change your password by entering your old password and new password in the form below:"
Bonus points if there's an 800 number to speak to a live person at the bank.
They'd piss a lot of people off, but sheesh (god forbid grandpa has to change from the 4-digit PIN he's been using ever since it was his locker combination in middle school). At least they have the confidence that if things ever go pear-shaped and someone makes off with their entire password database, it won't be easily cracked. And it gives *me* the confidence that they probably know what they're doing and have their password database properly salted and protected on their end.
Re:Nazi policies make cracking EASIER by CBravo · 2012-06-06 07:28 · Score: 1

and:
no sequences (abcdef...)
no repeating (aaaaa..., ababab... )

--
nosig today
Re:Nazi policies make cracking EASIER by JWSmythe · 2012-06-06 08:47 · Score: 1

7 limit password changes to N a month (with further changes being done at the IT office).
Why would you want to do that? The user should have the opportunity to change their password any time they feel it's necessary. If I want to go around changing my passwords daily, more power to me.
I've gone to sites where they botch the password updates. So I've had to do multiple password resets just to make it work. For example, if they happen to be stripping characters that assumed would be legitimate. I've seen places strip some or all of [!@#$%^&*()], so it accepts the submission, but hashes it one or more characters missing, therefore I can't log in with what I know the password to be. (i.e., "th@tp@$$" becomes "thtp"). I also change passwords any time I feel that I've been in a potentially insecure situation.
I've only noticed some sites strip characters, because I've experimented with dropping out non-alphanumeric characters when the known password doesn't work.

--
Serious? Seriousness is well above my pay grade.
Re:Nazi policies make cracking EASIER by RobertLTux · 2012-06-07 01:07 · Score: 1

limiting changes to N a month also limits how fast somebody could run a password "list" where the first and Nth+1 password is the same.

--
Any person using FTFY or editing my postings agrees to a US$50.00 charge

Re:So the real question is how secure is SHA 1 the by mtinsley · 2012-06-06 02:57 · Score: 1

There is no real risk of someone deriving a plain text password from a SHA1 hash (a preimage attack). There are concerns about SHA1 being vulnerable to a collision attack, but that isn't a problem for password hashing. The real concern when it comes to password hashing is speed. A fast hashing algorithm means it is easier to perform brute force searches. Of course, in order to perform a brute force or dictionary attack you need to know exactly how the hashes were generated. That means you need to know the algorithm, the salt (assuming one is used) and the number of rounds. If all you have is a list of hashes then you most likely won't accomplish anything.

As Yogi Berra would have said by ch-chuck · 2012-06-06 03:00 · Score: 2

Link me out

{ Actual quote: Include me out }

--
try { do() || do_not(); } catch (JediException err) { yoda(err); }

Random seed by wave9x · 2012-06-06 03:01 · Score: 1

It is a bit shocking that LinkedIn stores a simple hash of the password. Passwords can then be discovered by using a hash dictionary. A better approach would be to generate a random seed and combine the seed with the password to generate the hash, and store the seed with the hash. Then hash dictionary attacks become impossible.

Re:Random seed by MrAngryForNoReason · 2012-06-06 03:39 · Score: 1

A better approach would be to generate a random seed and combine the seed with the password to generate the hash, and store the seed with the hash.
What you are describing is basically salted hashes. You have a salt that you add to the password before you hash it. Normally the same salt is used for every password. This sounds less secure than what you describe as an attacker could generate one hash dictionary to attack all of the hashes but only using one salt means that you don't need to store them in the database with the hashes. This gives an extra level of security as an attacker who only has access to the database doesn't get the salt along with all of the hashes.
Re:Random seed by WuphonsReach · 2012-06-06 07:10 · Score: 2

You must make the assumption that the attacker knows both your salt(s) and how you apply the salt(s) to the password to create the hash.

Assuming otherwise allows you to do foolish things like use the same salt across multiple (or all) accounts. Which makes it trivial for an attacker to compute a single rainbow table and attack multiple accounts in one shot.

Having separate salts (at least 8-bit and preferably at least 16-bit or 32-bit) for every individual user gives you a last line of defense in the event that your password database is stolen and your salts/methods are exposed. With individual salts, the attacker is forced to brute-force attack every single account as a separate problem. Breaking one account doesn't automatically mean that other accounts are also broken.

--
Wolde you bothe eate your cake, and have your cake?

Re:The actual list by jones_supa · 2012-06-06 03:01 · Score: 1

I (the submitter) also wondered, where is this Russian forum that is being talked about around the Internet.

easy solution by ch-chuck · 2012-06-06 03:03 · Score: 1

Sign in, change passwd, sign out. Now only 6,458,019 valid hashes, and likely much less.

--
try { do() || do_not(); } catch (JediException err) { yoda(err); }

Re:easy solution by SuiteSisterMary · 2012-06-06 03:12 · Score: 1

Don't forget to change the password on all the other accounts with the same password on various websites and services that you use.

--
Vintage computer games and RPG books available. Email me if you're interested.
Re:easy solution by JWSmythe · 2012-06-06 08:50 · Score: 1

People still use the same password for multiple sites? :)

--
Serious? Seriousness is well above my pay grade.
Re:easy solution by Sunshinerat · 2012-06-06 10:30 · Score: 1

Yes, but with different logins (for sites like /.).
The different logins are remembered when I get to the site, the password is predictable when I need to do something.
When website business gets serious, a separate password schema is used (Bank, Web Stores, etc.).
To be honest, why would not every site let me choose how long my password is? I am a strong believer in the 'correct horse battery staple' method for passwords.

--
Load New Commander (Y/N)?
Re:easy solution by JWSmythe · 2012-06-06 13:51 · Score: 1

Ya, it really annoys me, I like generating long strong passwords, and keeping them stored safely away.
I get really annoyed when my password is rejected for being too long, or they won't accept the characters. I use standard ASCII characters, excluding similar ones (1, l, O, 0 ...). Some even refuse me for too many or two few numbers. It's nice to want numbers, but enforcing strict ruleset on the numbers is worthless. That's why people end up with stupid easy passwords. I'm not surprised people end up with stuff like abcd1234! , and you find their next ones are abcd1235! , abcd1236! {sigh}

--
Serious? Seriousness is well above my pay grade.
Re:easy solution by thogard · 2012-06-06 16:17 · Score: 1

IBM systems (like the 3081) would refuse double letters. So you couldn't use "abcdXXef"

Re:Could someone please look up my password for me by Rude+Turnip · 2012-06-06 03:07 · Score: 5, Funny

I can clearly see that it's hunter2.

--
Bill Clinton: Pimp we can believe in. - The Shirt!!!

Information security standards? by Wrath0fb0b · 2012-06-06 03:07 · Score: 3, Insightful

In cases like these, I feel like whoever is in charge of security over there needs to be held responsible for not following best practices and salting the damn password hashes. This has been security standard since PKCS #5 v2.0 -- and you know security professionals don't publish these standards just for their own health. And this is not a new fangled thing, it was finalized in 2000 12 years ago.

Failure to do so is malpractice ...

Hashes list link by xded · 2012-06-06 03:08 · Score: 5, Informative

http://www.mediafire.com/?n307hutksjstow3

When checking for your password, check both for its SHA-1 hash and for the SHA-1 hash with the first five chars zeroed. Quoting:

Some observations on this file:

0. This is a file of SHA1 hashes of short strings (i.e. passwords).

1. There are 3,521,180 hashes that begin with 00000. I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact.

Evidence for this is that the SHA1 hash of 'password' does not appear in the list, but the same hash with the first five characters set to 0 is.

5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 is not present
000001e4c9b93f3f0682250b6cf8331b7ee68fd8 is present

Same story for 'secret':

e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4 is not present
00000a1ba31ecd1ae84f75caaa474f3a663f05f4 is present

And for 'linkedin':

7728240c80b6bfd450849405e8500d6d207783b6 is not present
0000040c80b6bfd450849405e8500d6d207783b6 is present

2. There are 2,936,840 hashes that do not start with 00000 that can be attacked with JtR.

3. The implication of #1 is that if checking for your password and you have a simple password then you need to check for the truncated hash.

4. This may well actually be from LinkedIn. Using the partial hashes (above) I find the hashes for passwords linkedin, LinkedIn, L1nked1n, l1nked1n, L1nk3d1n, l1nk3d1n, linkedinsecret, linkedinpassword, ...

5. The file does not contain duplicates. LinkedIn claims a user base of 161m. This file contains 6.4m unique password hashes. That's 25 users per hash. Given the large amount of password reuse and poor password choices it is not improbable that this is the complete password file. Evidence against that thesis is that password of one person that I've asked is not in the list.

Re:Hashes list link by fincan · 2012-06-06 03:37 · Score: 1

Even if this is the real deal, I don't think this is all the password hash db of linked in, my randomly generated 16+ character password's hash does not exist in this even when substituting the first five chars with zeroes.
Re:Hashes list link by _0xd0ad · 2012-06-06 03:45 · Score: 1

Thanks for that info.
I checked the tail end of the SHA-1 hash of my LinkedIn password; it wasn't in the list, neither zeroed or in full. I'd already signed into LinkedIn and changed it, so it's moot, but yeah, my password wasn't in the dump.
Re:Hashes list link by fincan · 2012-06-06 03:46 · Score: 1

It is a more than a year old account, but less than 2 years old.
Re:Hashes list link by xded · 2012-06-06 03:56 · Score: 2

FWIW, my password hash (more than 1yo account) is not on the list. My girlfriend's one is (zeroed, 3 months old account), but her password is a quite easy/common one.
Re:Hashes list link by Sami+Lehtinen · 2012-06-06 03:56 · Score: 1

Same here, confirmed: Checked my current and old passwords (for 2 last years), no match. My password is also 16+ chars with plenty of special and skandinavian characters.
Re:Hashes list link by _0xd0ad · 2012-06-06 04:04 · Score: 1

Also, forgot to mention, isn't the implication of some cracked / some non cracked that whoever originally got their hands on the data only has the hashes, not the full passwords?
Of course, it's also possible that some scavenger started cracking the SHA-1 hashes in a file that someone else released...
Re:Hashes list link by AlXtreme · 2012-06-06 04:10 · Score: 1

My hash was on the list, in full. It was an old password, but a non-trivial long combination of (upper & lowercase) characters & numbers. Ouch!

--
This sig is intentionally left blank
Re:Hashes list link by DynamoJoe · 2012-06-06 04:34 · Score: 1

Great post. I was able to find my own hash without the 00000. I wasn't able to find common passwords until I swapped out the first five chars for 00000 and now they're all over the place.

--
bah.
Re:Hashes list link by aembleton · 2012-06-06 04:38 · Score: 1

Is there any reason why this passwords weren't salted?
Re:Hashes list link by tlhIngan · 2012-06-06 05:34 · Score: 2

Looking at the list, I noticed the last 8 characeters didn't appear to be as random as they appear...
E.g., take your password hash and look above and below it...

00000b3e292bbeed2d64d87eb1eb8aa2 7ee68c81 000001e4c9b93f3f0682250b6cf8331b 7ee68fd8 9c56af71aac0f64999c2a4ec3dc8a756 7ee68ffc

you'll notice the last 8 characetrs seem to be lacking in entropy - 7ee6xxxx
This is true throughout the file - it looks to be a 32-bit counter of something, increasing in some fashion.
Re:Hashes list link by SecurityGuy · 2012-06-06 05:37 · Score: 1

I don't know if you're expecting LinkedIn to comment, which I seriously doubt they will, but probably the same reason security shortcuts get taken everywhere. Laziness. Schedule pressure. Ignorance. Stubbornness. ("Damn SecurityGuy is always trying to make me more work! He's just paranoid. Nobody cracks SHA1!")
That's not an exhaustive list, obviously.
Re:Hashes list link by xded · 2012-06-06 06:32 · Score: 2

That's because the passwords are usually shorter than the hash itself. I haven't looked into the details, but I assume they sorted the hashes this way to group similar length passwords together.
Re:Hashes list link by rapiddescent · 2012-06-06 06:44 · Score: 1

Is it you cowboy neal?
the password "slashdot" 0000003627a75d6c96a3d965247584a78779bc3d has been used
Re:Hashes list link by capnchicken · 2012-06-06 07:38 · Score: 1

The forum text before it was blown away
From reddit:
http://www.reddit.com/r/technology/comments/unt92/russian_hackers_claim_to_have_65m_linkedin/

"dwdm"
Guys need you help again.
[2] link to hash
it's about 118Mb.
"M@LIK"
Alright, looks like no one wants to help here...
100 449 found
6 358 928 left
Can't upload left due to poor internet connection, use my founds as a dict instead.
More will be here soon! Already hit 15k more.
"charlie"
30077 new
"M@LIK"
+163 267 found : [3] http://www.mediafire.com/?bq8bd5iojp50zci
6 165 604 left (After importing all charlies' founds)
"CyberLord"
Hi guys
Where is last left list ? Anybody,Would you mind adding the left list please
POLIMO
Ok here my stuff !
236 578 Cracked one ( propably more to come if i have time...)
cracked pass come from the start post, cause no left....
The join file is on pass format ( no hashe:pass cause i use JTR & on heavy file is taking to much time to past, so feel free to load my pass & past them)
Here the patern i find :
*linkedin *
*link *
"alotdv"
55120 found after all
left : [4] http://www.mediafire.com/download.php?n307hutksjstow3

--
A libertarian shat on my carpet once. Claimed the free market would sort it out. -Ford Prefect(8777)
Re:Hashes list link by jittles · 2012-06-06 08:04 · Score: 1

They definitely had my linked in password. I was one of the first 500 or so users on linked in, and I haven't changed my password since I Created the account. I just changed it now...
Re:Hashes list link by Vintermann · 2012-06-07 02:01 · Score: 1

Thanks for sacrificing your password for verification purposes :) I can attest it was there. First digits were not zeroed out though, so this can stand as an example of the general kind of password that aren't immediately cracked.

--
xkcd is not in the sudoers file. This incident will be reported.
Re:Hashes list link by Dilaudid · 2012-06-12 03:09 · Score: 1

Neither mine nor my wife's is there. Hers is unchanged in 3 years.

Re:unique passwords for each website by presidenteloco · 2012-06-06 03:13 · Score: 1

And of course don't forget to store all your unique passwords that you have no hope of remembering in a plain-text file on your laptop and your smartphone, as well as on that piece of lined paper in the top drawer of your dresser.

--

Where are we going and why are we in a handbasket?

Just how many nails does the cloud's coffin take? by WOOFYGOOFY · 2012-06-06 03:16 · Score: 2

Just how many nails does this here cloud's coffin take ?

Legally mandated opening EULA clause:

"Your data is no longer private....".

These are not current password Hashs by Jadeinfosy · 2012-06-06 03:21 · Score: 5, Informative

I changed my LinkedIn password a while back (about a month ago or so) my old password shows up in the Hash not my new password.

Re:These are not current password Hashs by jittles · 2012-06-06 08:07 · Score: 1

Comments above indicate that the passwords are about 7 months old. Whether that is true or not, I don't know. But it had my 10 year old password in it.

Re:So the real question is how secure is SHA 1 the by Bengie · 2012-06-06 03:24 · Score: 1

I don't use SHA1

Pseudo-code:
PasswordHash = SHA512(MergeArray(txtPassword.GetBytes(),Salt[]))
Where Salt[] is a Cryptographic.RNG.GetBytes(32), which is stored in the DB and generated new every time the password is set.

oh again by Anonymous Coward · 2012-06-06 03:26 · Score: 1

Leakedin, Leakedin

Re:oh again by Lisandro · 2012-06-07 06:58 · Score: 1

Oh, the fun...

Re:Sleazeballs Enhanced by MonsterTrimble · 2012-06-06 03:29 · Score: 1

Not trying to be an ass, but can you direct me to info about why they're sleezeballs?

--
I call it 'The Aristocrats'

Hash file here by lixns21 · 2012-06-06 03:32 · Score: 3, Informative

The hash file here. I could find my password in there (after changing it). Who uses unsalted hashes? Is it 1991? https://mail.yandex.ru/disk/public/?hash=pCAcIfV7wxXCL/YPhObEEH5u5PKPlp+muGtgOEptAS4=

Re:So the real question is how secure is SHA 1 the by Sir_Sri · 2012-06-06 03:37 · Score: 1

Nor should you.

That was my point with the blurb as to whether or not this might be a specific problem. Linkedin has been around since 2003, it's not inconceivable that they would have used SHA 1 in 2003, or in some countries for some circumstances etc.

Re:Password changed by TheLink · 2012-06-06 03:43 · Score: 3, Interesting

If the hackers have great control of the site, just logging in to the site could give them access to your password _plaintext_.

So use different passwords for different sites.

--

Too many replies beneath your current threshold

Re:Password changed by TheLink · 2012-06-06 03:56 · Score: 1

Oh yeah. If you happen to use the same password on other sites. Change the passwords on the OTHER sites.

Don't bother doing that with LinkedIn. Treat the account as if the password is not a secret and cannot be a secret, until LinkedIn fixes stuff.

--

Too many replies beneath your current threshold

Re:Barbarians! by lister+king+of+smeg · 2012-06-06 03:59 · Score: 1, Flamebait

That's right they are hipster and emo's. Get it straight damn it! I am the barbarian because I don't us apple products. :-p

--
---Saying gnome 3 is better than windows 8 not so much a compliment as it is damning with light praise.

Re:So the real question is how secure is SHA 1 the by Sir_Sri · 2012-06-06 04:01 · Score: 1

Right, but as I say, you could be dead before they can brute force it. Depends on how strong your password is and how much computing power can be thrown at it.

It's not going to be a big shock to hackers that there are a lot of people on linkedin with passwords like 12345678 and linkedin. Without any immediately obvious way to tie passwords to accounts they're not a whole lot better off. Using a simply dictionary attack to verify that yes, there are shitty passwords isn't really making those accounts much less secure.

Re:So the real question is how secure is SHA 1 the by Sir_Sri · 2012-06-06 04:03 · Score: 1

ya but without any easy way to tie passwords to accounts there's nothing new there. Yes, lots of accounts on web services have bad passwords, that's not news to anyone.

So, if you have a Linked-in account, what now? by Rick+Bentley · 2012-06-06 04:29 · Score: 1

Please tell me if this sounds right. Hackers have your password (and probably your username). They can get into this site and any others on which you use the same password and (even similar) username. They have all your Linked-in info, therefore finding your FB username, for example, is probably pretty easy.

So, you can:
1) Change your Linked-in password. The security hole may not be fixed yet so you may just be handing them your newer password. Do it anyway with a throwaway password you use just for Linked-in.
2) Change your password on every other site on which you used the same password as you did on Linked-in (but don't change your password on Linked-in to the same thing for reasons above).

Yes, I know, ideally we have a different password for every single site ... it's just not practical. I personally have three distinct passwords I use: simple: for sites I really don't care about medium: for sites like Linked-in where it would be bothersome if it were breached but there is no credit card info etc. strong: for sites like banking, ebay, amazon, etc. where access can cost me money.

Any other thoughts as to the current best course of action for those of us with Linked-in accounts?

--
My favorite quote doesn't fit into 120 characters. Now no one will like me.

Re:So, if you have a Linked-in account, what now? by SecurityGuy · 2012-06-06 05:32 · Score: 3, Informative

You already know the answer. You just don't like it.
You say that using a different password for every site is not practical. Is it less practical than having to deal with Site A getting hacked and your bank account being emptied? For me, I'm perfectly willing to deal with the hassle of separate passwords.
What I'd suggest is that your "strong" category should all have distinct, strong passwords. I'm fond of 16+ random characters including numbers, caps, specials, etc. It's crazy to trust Amazon and eBay, both giant companies which big targets on their back filled with employees who may or may not be honest, with your bank password. Write 'em down if you have to. You can keep them in your wallet with no note about what they are or usernames, encrypted on your phone, whatever. If that's not good enough, lock them in a safe at home.
I do agree with having a throwaway class of password. I will reuse passwords across sites if they're sites I really don't care about. I don't really have a medium. If having it compromised would be bothersome, it gets its own password.
Re:So, if you have a Linked-in account, what now? by erp_consultant · 2012-06-06 05:38 · Score: 2

Try Keepass (keepass.info). It's an excellent, free password manager. There are others as well (LastPass is one that comes to mind). No excuses for not having a different password for each site you visit. As far as LinkedIn goes, changing the password is about all you need to do. You might want to monitor it for the next few days for any suspicious behavior. Evidently the password leak was via iOS so if you're not logging in with an iPhone or iPad then you're probably not affected. Does't hurt to change your password though.
Re:So, if you have a Linked-in account, what now? by EXrider · 2012-06-06 11:04 · Score: 1

Evidently the password leak was via iOS so if you're not logging in with an iPhone or iPad then you're probably not affected.
I've never, ever even installed a LinkedIn app on my iPhone or any other mobile device, nor has my co-worker. Both of our passwords were found on the list with the leading 0's. I agree that their app is shitty because it doesn't encrypt communications, but I'm pretty certain it has nothing to do with the compromised passwords. Also, another co-worker who does use the iOS apps, did not find their password on the list.

--
grep -iw skynet /etc/services
Re:So, if you have a Linked-in account, what now? by wurp · 2012-06-06 14:08 · Score: 1

I agree that your bank password should be different from your Amazon password, but please don't list eBay and Amazon as if they are on par with one another regarding password security.
Amazon takes customer trust astoundingly seriously, and has more than a decade of contributions by very bright engineers to protect your password. There are systems, and meta-systems, and corporate policies, and repeated internal emails reiterating the importance of defense social as well as technical attacks.
eBay may be great at keeping your data safe, but I very much doubt they go to the lengths or apply the ingenuity that Amazon does.
Re:So, if you have a Linked-in account, what now? by Vintermann · 2012-06-07 02:09 · Score: 1

Yes, I know, ideally we have a different password for every single site ... it's just not practical.
It is. Most of these sites offer password reset options. If your mail account is protected by two-factor authentication (as is easy to set up with GMail), you can use secure passwords on each individual site, use your browser to remember it, and just reset it to something else random if you forget it and need to log in somewhere it isn't stored.
You keep all the security of your mail account - which is a weak point in all these sites' security anyway, since it can be used to reset passwords.
I used to do your scheme with a "low security" password, but it was lazy. After Google got two-factor authentication (and yes, there are emergency methods if you should lose your token/phone), and my security-conscious big brother got an account cracked, I didn't have any excuse any more.

--
xkcd is not in the sudoers file. This incident will be reported.
Re:So, if you have a Linked-in account, what now? by Vintermann · 2012-06-07 02:15 · Score: 1

I'm fond of 16+ random characters including numbers, caps, specials, etc.
It doesn't hurt to come up with a more memorable format. As XKCD pointed out, these passwords are hard for humans, and comparatively easier for computers. I've written a script which produces fairly memorable passphrases, which should be safe even if the script becomes public. No point in revealing the exact scheme, but I can say it's a modest customization of a simple random password generation snippet.

--
xkcd is not in the sudoers file. This incident will be reported.
Re:So, if you have a Linked-in account, what now? by DMUTPeregrine · 2012-06-07 12:17 · Score: 1

I have a similar system:
Weak sites and one-offs: I really, really don't care. The password is the golden ratio.
Medium sites: hash(FiveWordDicewarePassphrase+SiteName) It's different for every site, but easy to remember and use.
High security: Each site has a different diceware phrase, hashed and salted by copy+pasting the site name (as above). This also helps prevent unicode look-alike character phishing attacks from working, since the hash comes out wrong.

--
Not a sentence!
Re:So, if you have a Linked-in account, what now? by ShakaUVM · 2012-06-12 03:31 · Score: 1

I have unique passwords for every serious site that I use (banking, credit cards, etc.)
I use the same throwaway password for websites that I don't give a rat's ass about.
Worst case scenario is that someone impersonates me on Slashdot.

my 10+-year old password is not on that list by meyering · 2012-06-06 05:08 · Score: 1

My password, unchanged for ~10 years, is not on that list either.
I've just confirmed that the password I chose back then was still valid
as I changed it today.

Re:my 10+-year old password is not on that list by FormOfActionBanana · 2012-06-06 18:53 · Score: 1

With the 00000 mask?

--
Take off every 'sig' !!

Re:unique passwords for each website by AliasMarlowe · 2012-06-06 05:12 · Score: 1

And of course don't forget to store all your unique passwords that you have no hope of remembering in a plain-text file on your laptop and your smartphone, as well as on that piece of lined paper in the top drawer of your dresser.

This is either funny or sad, because probably a lot of people do exactly that. The blame belongs to the many sites with bad password policies or insecure password practices (including LinkedIn, apparently).

Here's the safer way to do it. Pick a passphrase of suitable length which you will remember, "QuintusFabiusMaximusCunctator" for example, then use that phrase to generate unique passwords by combining it with the site's web address. For instance, with LinkedIn, you'd have a password:
echo -n "QuintusFabiusMaximusCunctator-www.linkedin.com" | sha512sum | xxd -r -p | tr -cd [:print:] | sed -e "s/ //g"
which yields:
dIf{0,L$VwZVId3Z2#qfow@8FVAP
which is below the paranoid level of security, but gives fairly secure unique passwords per site. If passwords must be changed occasionally, then year and month can be appended. The command can be kept (ideally without your passphrase) in a post-it note or a desktop sticky for cut&paste.

--
Those who can make you believe absurdities can make you commit atrocities. - Voltaire

Re:So the real question is how secure is SHA 1 the by AmiMoJo · 2012-06-06 05:17 · Score: 2

The wonderful thing about having 6.5 million password hashes to play with is that a simple dictionary attack will probably get you a couple of million plaintext ones within hours. No need to look for weaknesses in SHA 1, just like there is no need for the cheetah to catch the gazelle at the front of the pack when there are plenty of easy pickings at the back.

--
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC

LinkedIn bashing? by erp_consultant · 2012-06-06 05:32 · Score: 2

What's with all the LinkedIn bashing? I have been using it for years and have never gotten any spam from them. It's a great resource and has gotten me more than one job.

Re:LinkedIn bashing? by codepunk · 2012-06-06 07:26 · Score: 1

Dropped mine long ago when they started spamming the hell out of me.

--

Got Code?
Re:LinkedIn bashing? by eulernet · 2012-06-06 10:20 · Score: 1

Because they admit that the accounts were compromised:
http://blog.linkedin.com/2012/06/06/linkedin-member-passwords-compromised/
and they blame the users (remember: they were compromised, not the users !):
http://blog.linkedin.com/2012/06/06/updating-your-password-on-linkedin-and-other-account-security-best-practices/

While our investigation continues, we thought it would be a good idea to remind our members that one of the best ways to protect your privacy and security online is to craft a strong password, to change it frequently (at least once a quarter or every few months) and to not use the same password on multiple sites.
Why should I change my password if I use it only on their site ?
A lot of sites implement new kinds of input boxes, where your browser cannot save the password !
It's humanly impossible to remember all passwords.
Re:LinkedIn bashing? by erp_consultant · 2012-06-06 10:26 · Score: 1

Just curious...what kind of spamming did you get? Do you mean from recruiters or from LinkedIn itself? I wonder what I've done to avoid all of that :-)

Passfault Is an Eye-Opener by monk · 2012-06-06 06:27 · Score: 1

I really hate to link xkcd but they are on the money with this one.
http://xkcd.com/936/

I'm getting tired of having to have ridiculous passwords, now I'm just either ALWAYS making the first character an uppercase because it's easier, or doing quick pattern based passwords for the ultra fussy systems.
123qwe!@#QWE - that's surprisingly quick to input yet keeps those stupid systems quiet.

They can have my linked-in hash. Based on a similar pattern is should take 11945132084526 centuries to crack according to passfault.

For the lame systems that insist on bad passwords, I just generate something random in keepassX

--
[-- Trust the Monkey --]

Not a complete password list by trev.norris · 2012-06-06 06:29 · Score: 1

I can confirm that this is not a complete list. None of the passwords I've ever used are in the list.

How to check for your password (single command) by Khopesh · 2012-06-06 06:29 · Score: 1

If you're on a *nix system like Mac or Linux, you can check against the file (after downloading and unraring) with:

echo Type password and hit enter;stty -echo; read p; echo -n "$p" |shasum |cut -c6-40 |sed 's/$/$/' |grep -f- SHA1.txt; unset p; stty echo

If there is output, your password is probably exposed.

You can verify this methodology with any of the common passwords (like "password" sans quotes). Note that this isn't perfect; if it has a hit, it might have overlapped on the first five characters. There's also no guarantee that this is a full list (which is to say, change your password even if you don't find it here).

--
Use my userscript to add story images to Slashdot. There's no going back.

Re:How to check for your password (single command) by Anonymous Coward · 2012-06-06 08:03 · Score: 1

Or simply:
grep `echo -n l1nkedIn | shasum | cut -c 6-40` SHA1.txt 00000a96145d2b6cb64130434758febbe498b123
where "l1nkedIn" is the password you are checking for, if nobody is watching over your shoulder!
Re:How to check for your password (single command) by Khopesh · 2012-06-07 08:58 · Score: 1

Or simply:
grep `echo -n l1nkedIn | shasum | cut -c 6-40` SHA1.txt 00000a96145d2b6cb64130434758febbe498b123
That puts your password into both the process list and your command history. My method does neither.

--
Use my userscript to add story images to Slashdot. There's no going back.

Re:So the real question is how secure is SHA 1 the by Sir_Sri · 2012-06-06 06:38 · Score: 1

Sure. But people with trivial passwords never had any hope of security anyway, we can discount those accounts and identities and write them off with or without this leak. It's everyone else I'd be worried about.

Re:So the real question is how secure is SHA 1 the by Sir_Sri · 2012-06-06 06:41 · Score: 1

'most' is a strong word here. If most people have terrible passwords there was never really anything you could do to save them and their accounts, especially if they reused those passwords.

The interesting part is the ones that won't show up in rainbow tables.

This breach is looking very very bad. by Anonymous Coward · 2012-06-06 06:55 · Score: 3, Insightful

Wow, the LinkedIn hacking looks a lot worse as the hours roll by. There is no indication that the security breach has been fixed yet, so logging into LinkedIn to change your password might be futile - the hackers might still be in there and now they've got your new password too.

But thats not the worst, no not by a long shot. The 6.5 million password hashes that were uploaded to the Russian hacker forum are unique - i.e. any duplicate hashes are filtered out. Assuming some users pick the same "easy" passwords, it means the 6.5 million passwords could easily be a very significant chunk of the LinkedIn user base.

And lets take that a step further - until we know any better, we have to assume that the group who hacked LinkedIn and stole those passwords got away with at least your LinkedIn username too. Which is your email address. You didn't use the same password for your email account as you did for your LinkedIn account did you? Oh wait you did.. Better go change your email password too. This list of email addresses alone is very valuable to the dark side of the internet as it's a huge list of confirmed, valid emails addresses.

Its never great to be the bearer of bad news, but what was that - yes, that was it. LinkedIn also allows you to link your profile to your social media accounts - Facebook, Twitter, your private blog, etc etc. If you used the same email address and password to log into those accounts as you did for LinkedIn, you better get moving quick to change all of those passwords too (please, please use a different password for each site this time!) as at this point we have to assume the worst and that the hackers got the details about your linked profiles too.

For some users, your credit card information may have been stored too so you could "upgrade" your LinkedIn account. Oh and your profile probably has your address on it.

Finally, this opens up LinkedIn users to massive identity theft - generally LinkedIn users have uploaded their full CVs. That might even include your birthday and for married people your maiden name. It could easily show your first high school, where you went to college, the name of your first employer, etc etc. What are all those sort of details used for? Accessing your bank account, resetting passwords via security questions, you know, proving your identity online. Ouch.

This hack has potential to be bad. Really really bad. And until we know the size of the breach we have no idea how far reaching it could ultimately end up.

LinkedIn - A Networking Tool by Cheech+Wizard · 2012-06-06 07:21 · Score: 2

I'm retired but I do have a LinkedIn account and am "connected" to a lot of people in my old profession. Several people I know got very nice jobs through LinkedIn. One got a job as Director of Global Quality for a large Chinese company (and this person is from India) and has quite a nice salary.

I'm not much for social networks, and I don't spend time on LinkedIn but I use it and I personally think it's a good tool for many professionals. I have never gotten any spam from LinkedIn or LinkedIn "members'.

Re:LinkedIn - A Networking Tool by RockDoctor · 2012-06-07 11:26 · Score: 1

I have never gotten any spam from LinkedIn or LinkedIn "members'.
Lucky you!
Or perhaps it's a consequence of you being flagged as "retired."
I'm active in my industry, and have a blunt statement in my Linked-In resume that I am not at all interested in receiving job offers that would require me to leave my current employment, though if people have projects they think I'd be suitable for, then they should contact my line manager to discuss rates etc.
I still get around one serious request a week from a headhunting idiot for me to contact them about an "exciting new opportunity". Which gets circular-filed, and reported as abuse through the Linked-in system. Which part of "read my fucking CV?" do these twats not understand? Probably the bit about "read" - if they could do that, they'd be flipping burgers instead of working in head-hunting shops.

--
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"

Re:Sleazeballs Enhanced by Anonymous Coward · 2012-06-06 07:25 · Score: 1

You exist and are on the internet. In short, you admit to being a sleezeball....

Re:So the real question is how secure is SHA 1 the by dkf · 2012-06-06 08:59 · Score: 1

But people with trivial passwords never had any hope of security anyway, we can discount those accounts and identities and write them off with or without this leak. It's everyone else I'd be worried about.

Gosh, aren't we elitist today! Do you really think that lots of people use super-strong passwords for LinkedIn of all sites?

The real question is how well salted the passwords are; with appropriate salting, it's still going to be awkward to crack since you won't be able to use techniques like rainbow tables. (Also, if the salt is different from that found on other sites, it is still not very much use to find a solution to what can produce the SHA-1 hash, since a different site that uses a different salt source will have different collisions; about all the attacker could count on doing is log into LinkedIn...)

--
"Little does he know, but there is no 'I' in 'Idiot'!"

Re:unique passwords for each website by nullchar · 2012-06-06 09:14 · Score: 1

Don't forget to protect your .bash_history!

LinkedIn has just confirmed the breach by Lisandro · 2012-06-06 09:51 · Score: 3, Informative

http://blog.linkedin.com/2012/06/06/linkedin-member-passwords-compromised/

Re:LinkedIn has just confirmed the breach by Linuxmagic · 2012-06-07 06:47 · Score: 1

Oh, this looks fun.. Now we can expect another round of phishing emails for LinkedIn. "These members will also receive an email from LinkedIn with instructions on how to reset their passwords. There will not be any links in this email. Once you follow this step and request password assistance, then you will receive an email from LinkedIn with a password reset link." Yep, click on this link from yoru trusted service, honest it is them.. and not a link to a page that asks your for your information so we can match it to the information we have on hand.. oh, and don't worry.. clicking on this will not install a virus/trojan that will get all the rest of your passwords...
Re:LinkedIn has just confirmed the breach by Lisandro · 2012-06-07 06:54 · Score: 1

A couple of coworkers have already received (legitimate) heads-up to change their passwords, so yes, i can definitely see this happening. Someone screwed up big time at LinkedIn...

OpenID by Galestar · 2012-06-06 11:46 · Score: 1

Its about time they got off their asses and implemented support for OpenID.

--
AccountKiller

Re:So the real question is how secure is SHA 1 the by Sir_Sri · 2012-06-06 12:07 · Score: 1

The passwords aren't salted at all, we already knew that.

And I'm not being elitist. A job seeking site is as close as you can get to taking basically everything important in someones identity shy of their social insurance/security number and bank account information, and some people have (or used to have) that info on resumes. Their work history, work contacts, education, address, contact info etc it's all there, the entire history of your professional life. I fully expect a huge portion of users to have terrible passwords. Because on every service in existence lots of people have terrible passwords. And my point is if your password is 12345678 you're not meaningfully less secure now than you were 2 days ago. Especially not without salting.

Any minimally competent man in the middle attack of any sort could have gotten the password hashes, or one could simply, on any service, try the few most common passwords on every account you can find and see what happens. This is not meaningfully worse than being able to do that.

They got my password by Aggrajag · 2012-06-06 15:56 · Score: 1

The list had hash of my password but I've deleted my account long ago. Luckily I used a one time password that I didn't use anywhere else.

Re:Do I need to change my password? by lixns21 · 2012-06-06 21:18 · Score: 1

It is very likely they have the information linking the two. In your case it seems like the harm would have been limited to the Linkedin site, if you had not changed your password. They would most likely make money by hijacking your accounting and posting/messaging spammy links to your friends. But *many* people use same/similar passwords and mail id combos (evident from the password choices). They have more reason to be worried - FB, Twitter, In all hijacked!

Re:Password changed by lipanitech · 2012-06-07 05:22 · Score: 1

Just goes to show does not matter how good the password if the hacker wants in there getting in

--
http://thetechnologygeek.org/

Re:linked tweet in dutch? by RalphTheWonderLlama · 2012-06-07 06:25 · Score: 1

Orly?

--
simple, fast homepage with your links: http://www.ngumbi.com/

LinkedIn also leaked out my email address earlier by kontio · 2012-06-09 00:38 · Score: 1

These news might explain why earlier this spring I started receiving spam to the email address I had given to LinkedIn and no one else. The format of the disposable email address was such that it could not be guessed. I have something like 100 of these disposable email addresses and the others and the others haven't leaked so I don't think the leak happened at my end. That leaves LinkedIn as the source of the leak and I was wondering if they knowingly sold out my email address that shouldn't have been public or if they got hacked. Now it seems it might have been the latter. This comment says: "I changed my LinkedIn password a while back (about a month ago or so) my old password shows up in the Hash not my new password." ( http://it.slashdot.org/comments.pl?sid=2898871&cid=40232837 ). That would fit with the idea that the breach happened some time ago, not in the past few weeks. I contacted LinkedIn and asked for an explanation but they didn't bother to answer. I'm sure they were too busy investigating the breach and informing their customers that their data has been stolen or something. Well, in the end I don't know why my email address was leaked. But I do think that they should at least have provided an explanation and an apology when I contacted them.

Re:Sleazeballs Enhanced by Phasma+Felis · 2012-06-11 07:21 · Score: 1

This is Slashdot. Anyone who runs a business on the internet is a sleazeball.

Slashdot Mirror

LinkedIn Password Hashes Leaked Online

191 of 271 comments (clear)