4 ms·
> If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously. One assumes LinkedIn does not store pl
by lazaroclapp 10y ago
> If the passwords were leaked due to being stored in plain-text, no amount of complexity would protect them, obviously.
One assumes LinkedIn does not store plain text passwords anywhere. That would be against best practice for the average PhpBB online forum from the late 90s. It would be criminal negligence from a company like LinkedIn. How strong your password is (and which kind of hashing function the site uses) does influence how long it takes to obtain a plausible plain text password assuming that the exfiltrated data is in the form of a list of salted hashes, which is the most reasonable assumption.
That said, changing passwords everywhere remains the safest course. Since: a) 4 years is a long time to run a password cracker + dictionary, b) there is always the possibility that the passwords were intercepted on server memory before hashing.
- Jhsto 10y agoThe said dump contains unsalted SHA1 encrypted passwords: https://www.leakedsource.com/blog/linkedin https://www.leakedsource.com/blog/linkedin
- buovjaga 10y agoIs there a complete list of the DBs in leakedsource.com somewhere? They have this result: VerticalScope Network (Vbulletin) (939 Websites). Would be nice to know all of those 939 sites.
- Jhsto 10y agoIf you'd really want to know, I would suggest contacting the website admin on HackForums.
- ashitlerferad 10y agos/encrypted/hashed/
- kazinator 10y agoNitpicking. Even the Unix guys, whose line editing language you're using there, called the password hashing function "crypt"; everyone knows what it means.
- cyphar 10y ago"crypt" = "cryptographic hash" != "encryption". Not to mention that someone might get the wrong idea and decide that encryption (or single-round hashing) is good enough.
- kazinator 10y agohttps://www.freebsd.org/cgi/man.cgi?crypt%283%29 https://www.freebsd.org/cgi/man.cgi?crypt%283%29 NAME crypt -- Trapdoor encryption Linux man page: NAME crypt, crypt_r - password and data encryption Solaris 10 man page: NAME crypt - string encoding function Darwin: DESCRIPTION The crypt() function performs password encryption ...
- cyphar 10y agoTo be fair, "trapdoor encryption" == "hash".
- deleted 10y ago[deleted]
- deleted 10y ago[deleted]
- PostThisTooFast 10y agoLinkedIn still implements this moronic policy, which makes every breach worse: http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use-e-mail-address-as.html http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use...
- evilDagmar 10y agoOne assumes LinkedIn would also know better than to tell users "We'd like to import your contact list to match you up with existing members" and then go ahead and spam everyone in that contact list about joining linked in, but that was also shown to be an incorrect assumption. The only thing one should ever assume with respect to _security_ is that the other party is going to do it wrong unless it's written out for them.