5 ms·

Do we know how strong their hashing scheme was? Edit: SHA-1... You'd think a site as big as linkedin would have strong hashing...

conradk 10y ago
Just read about it being sha-1 (source: http://www.pcworld.com/article/257045/security/6-5m-linkedin-passwords-posted-online-after-apparent-hack.html http://www.pcworld.com/article/257045/security/6-5m-linkedin...).
- vthallam 10y ago
  Sha-1 with the hashes salted. Edit: "Motherboard conversed with someone at LeakedSource who claimed that they managed to crack 90 percent of the LinkedIn passwords within three days. Though LinkedIn says it has hashed and salted its stored passwords for several years now" http://venturebeat.com/2016/05/18/linkedin-resets-passwords-on-millions-of-accounts-as-new-data-leak-reports-surface/ http://venturebeat.com/2016/05/18/linkedin-resets-passwords-...
  - zaroth 10y ago
    Unsalted
- zaroth 10y ago
  From that 2012 article: "What's also troubling security researchers is that the password database contains entirely unique passwords. It's unclear whether the people who leaked the password file have more passwords that have not surfaced online. The file may, for example, be an attempt to crowd source the hacking of some of the more difficult passwords." Well Per Thorsheim called that one!
bogomipz 10y ago
Why would you think that? Linkedin isn't really known for substance or integrity are they? Also didn't it come to light that they didn't use salts either?
- tptacek 10y ago
  LinkedIn has a solid security team today. That was probably not the case when this breach apparently happened, though. Just because the dump leaked today has SHA-1 hashes, doesn't mean that's what they're doing now.
  - manigandham 10y ago
    They should have never been doing that. And they regardless of what team they have, they have a terrible perception.
    - tptacek 10y ago
      I'm not invested in changing your opinion of LinkedIn. I'm not a fan either. I'm just clarifying that the team there now didn't have anything to do with what happened in (apparently) 2012, and I would not count on your assumptions of what they're doing with passwords as being valid anymore.
    - wglb 10y ago
      Even that few years ago, the percentage of companies doing exactly that was pretty large. The message about bcrypt has in fact made its mark.
  - ryanlol 10y ago
    No, a "solid security team" doesn't wait 4 years to do password resets, nor do they let people use their personal emails for work repos. "There are no experts, only various levels of incompetence" ;)
- wglb 10y ago
  If you look at Cory Scott's linked-in profile, you can see that there was NO security team before he was hired. None. The breach happened before he arrived, and he is now having to deal with a four year old breach. He has built a substantial team from nothing and from what I can tell is doing all the right things.
jlgaddis 10y ago
Unsalted SHA1.
- adriancooney 10y ago
  This is just unforgivable. This is such an incredibly basic and simple to implement feature and they've just ignored it. There should be some legal repercussions for companies neglecting security. When they surpass 100,000 users, a mandatory security audit should be passed (like a health and safety inspection). Data breaches like these just happen far too often.
  - ryanlol 10y ago
    Hardly, in reality salting simply doesn't make much of a difference. It's the algorithm used that matters here.
Diederich 10y ago
It was their legacy but still in use auth system. Accounts created past some cutoff (before the exploit) were in another, more secure system that did not use sha1. They didn't move fast enough to get accounts moved over.

conradk 10y ago

Just read about it being sha-1 (source: http://www.pcworld.com/article/257045/security/6-5m-linkedin-passwords-posted-online-after-apparent-hack.html http://www.pcworld.com/article/257045/security/6-5m-linkedin...).

vthallam 10y ago
Sha-1 with the hashes salted. Edit: "Motherboard conversed with someone at LeakedSource who claimed that they managed to crack 90 percent of the LinkedIn passwords within three days. Though LinkedIn says it has hashed and salted its stored passwords for several years now" http://venturebeat.com/2016/05/18/linkedin-resets-passwords-on-millions-of-accounts-as-new-data-leak-reports-surface/ http://venturebeat.com/2016/05/18/linkedin-resets-passwords-...
- zaroth 10y ago
  Unsalted
zaroth 10y ago
From that 2012 article: "What's also troubling security researchers is that the password database contains entirely unique passwords. It's unclear whether the people who leaked the password file have more passwords that have not surfaced online. The file may, for example, be an attempt to crowd source the hacking of some of the more difficult passwords." Well Per Thorsheim called that one!

bogomipz 10y ago

Why would you think that? Linkedin isn't really known for substance or integrity are they? Also didn't it come to light that they didn't use salts either?

tptacek 10y ago
LinkedIn has a solid security team today. That was probably not the case when this breach apparently happened, though. Just because the dump leaked today has SHA-1 hashes, doesn't mean that's what they're doing now.
- manigandham 10y ago
  They should have never been doing that. And they regardless of what team they have, they have a terrible perception.
  - tptacek 10y ago
    I'm not invested in changing your opinion of LinkedIn. I'm not a fan either. I'm just clarifying that the team there now didn't have anything to do with what happened in (apparently) 2012, and I would not count on your assumptions of what they're doing with passwords as being valid anymore.
  - wglb 10y ago
    Even that few years ago, the percentage of companies doing exactly that was pretty large. The message about bcrypt has in fact made its mark.
- ryanlol 10y ago
  No, a "solid security team" doesn't wait 4 years to do password resets, nor do they let people use their personal emails for work repos. "There are no experts, only various levels of incompetence" ;)
wglb 10y ago
If you look at Cory Scott's linked-in profile, you can see that there was NO security team before he was hired. None. The breach happened before he arrived, and he is now having to deal with a four year old breach. He has built a substantial team from nothing and from what I can tell is doing all the right things.

jlgaddis 10y ago

Unsalted SHA1.

adriancooney 10y ago
This is just unforgivable. This is such an incredibly basic and simple to implement feature and they've just ignored it. There should be some legal repercussions for companies neglecting security. When they surpass 100,000 users, a mandatory security audit should be passed (like a health and safety inspection). Data breaches like these just happen far too often.
- ryanlol 10y ago
  Hardly, in reality salting simply doesn't make much of a difference. It's the algorithm used that matters here.

Diederich 10y ago

It was their legacy but still in use auth system. Accounts created past some cutoff (before the exploit) were in another, more secure system that did not use sha1. They didn't move fast enough to get accounts moved over.