3 ms·

Just a thought, but GitHub could be handling this proactively to ensure the security of their members given the sensitivity of private repositories: Step 1

Just a thought, but GitHub could be handling this proactively to ensure the security of their members given the sensitivity of private repositories: Step 1: Grab LinkedIn breach data Step 2: Compare email addresses/usernames from LinkedIn to GitHub Step 3: Check if passwords are the same Step 4: Reset password and notify if they match

zaroth 10y ago
Step 3 is not possible without one of the following; GitHub keeps a copy of the password in plain-text GitHub keeps a copy of the SHA1 hash of the password GitHub cracks the SHA1 hash and checks against their hash GitHub calculates the SHA1 hash of the password after a valid login The 4th option is the only sane approach, but it means you can't 'Check if passwords are the same' in bulk, only as users login.
- Someone1234 10y ago
  The LinkedIn dump is trivial to convert back into plain text. They're all SHA1 hashes and aren't salted. You can just download an SHA1 rainbow table[0] and instantly convert them to plain text. [0] http://project-rainbowcrack.com/table.htm http://project-rainbowcrack.com/table.htm
  - jeffjose 10y ago
    Correct me if I'm wrong, but rainbow table is for popular password and character combinations yes? If my password is s0m3th1nggsup33rhard, you cant make out the string from the rainbow table.
    - chrisrhoden 10y ago
      You're wrong. It's not just a dictionary. While tables are generated with a cap on length and characters used that's not the same as being for popular passwords.
    - Someone1234 10y ago
      Depends on the specific rainbow table. The ones I linked to are brute force, every single SHA1 hash for all common ascii characters up to 8 digits long. You can also download smaller rainbow tables for common passwords, dictionaries, or similar. Ultimately SHA1 is extremely fast to commute in 2016. So even if a rainbow table doesn't suit your needs, you can easily generate a new one which does, but likely you'll break a good chunk of passwords just using the "out of the box" 1-9 A-Za-z0-9 and specials rainbow tables.

zaroth 10y ago

Step 3 is not possible without one of the following; GitHub keeps a copy of the password in plain-text GitHub keeps a copy of the SHA1 hash of the password GitHub cracks the SHA1 hash and checks against their hash GitHub calculates the SHA1 hash of the password after a valid login The 4th option is the only sane approach, but it means you can't 'Check if passwords are the same' in bulk, only as users login.

Someone1234 10y ago
The LinkedIn dump is trivial to convert back into plain text. They're all SHA1 hashes and aren't salted. You can just download an SHA1 rainbow table[0] and instantly convert them to plain text. [0] http://project-rainbowcrack.com/table.htm http://project-rainbowcrack.com/table.htm
- jeffjose 10y ago
  Correct me if I'm wrong, but rainbow table is for popular password and character combinations yes? If my password is s0m3th1nggsup33rhard, you cant make out the string from the rainbow table.
  - chrisrhoden 10y ago
    You're wrong. It's not just a dictionary. While tables are generated with a cap on length and characters used that's not the same as being for popular passwords.
  - Someone1234 10y ago
    Depends on the specific rainbow table. The ones I linked to are brute force, every single SHA1 hash for all common ascii characters up to 8 digits long. You can also download smaller rainbow tables for common passwords, dictionaries, or similar. Ultimately SHA1 is extremely fast to commute in 2016. So even if a rainbow table doesn't suit your needs, you can easily generate a new one which does, but likely you'll break a good chunk of passwords just using the "out of the box" 1-9 A-Za-z0-9 and specials rainbow tables.