5 ms·
Good Guy Startup Founder would cross reference this password list with their own password system and force those that match to reauthenticate and change their p
by tazzy531 14y ago
Good Guy Startup Founder would cross reference this password list with their own password system and force those that match to reauthenticate and change their passwords.
This wouldn't be difficult to do and your users would appreciate it.
- deleted 14y ago[deleted]
- mibbitier 14y agoPossible that they only uploaded the "hard" ones. Looks from other comments here that people have found their own passwords, unsalted.
- Xion 14y agoI've found '1234678', 'password', 'qwerty', 'linkedin' and few other common phrases (already 00000'd, obviously), so it doesn't look like a list of just the hard ones.
- philip1209 14y agoOr, they could take the Zappos route and just force everybody to reset their passwords. This route would make adopting a different (e.g. salted) password system quite straightforward.
- jere 14y agoHow would one cross-reference this list unless you're storing the plain text passwords?
- ryusage 14y agoThe released passwords are hashed with SHA1. Assuming you use the same algorithm and linkedin does not use a salt (they probably do), then you could just compare the hashes.
- swombat 14y agoYou can't compare the hashes unless you have access to the clear passwords of your users. Unless you mean to do the comparison just as they log in. Seems like a lot of hassle for not much though.
- veemjeem 14y agoLinkedIn passwords are not salted. You can only make comparisons if your database contains unsalted passwords. And if both databases used salted-passwords, then you still can't compare unless you all shared the same salting key.
- raldi 14y agoOr do it the next time they log in, when you temporarily have their cleartext password.
- rplnt 14y agoMaybe he was implying that they and Good Guys Startupers use hashes from raw passwords. I hope that is not true. edit: From reading comments bellow I learned that LinkedIn indeed didn't salt.
- LinXitoW 14y agoyou'd compare the hashes in your database with those from the file. The users with a hash contained in the file would be notified. Because the passwords aren't salted(stupid), you might get multiple hits for the same hash(for example, for the good old "1234" password), meaning you might end up contacting more users than actually affected. Better safe than sorry.
- toyg 14y agoYou'd do it at login time. User enters user/pwd -> hash with unsalted sha-1, check if in list -> if yes, alert to change / if no, proceed with normal hashing.
- veemjeem 14y agoEasy, just convert all the hashes into passwords using a rainbow table. Should only take a few seconds to convert all 6.5M passwords -- O(n) operation here. Then run all the passwords through each user's password algorithm, this is a O(n^2) operation. Essentially you're making 6.5M password attempts for each of your users. It could be slightly faster because I'm sure there are quite a few duplicates in 6.5M passwords.
- iamstef 14y agoA cross-reference is only feasible in very bad situations: - no-salt or same-salt and same hashing - trivial/common passwords (password1 etc) - password(hashed/unhashed) and email are paired. A cross-reference could be accomplished for all known cracked linkedin passwords, but this would be no different then you running a dictionary attack of known passwords against your own users... This seems very bad. Enforcing strong but sane password strength rules should mitigate this need. Cross reference only has value if both the hash and email pairs are leaked. The bitcoin leak fell into one of these very bad situations: - [<email>, <hash>] where leaked together - poor hashing (just sha1, no salt if memory serves) - unfortunate number of people reuse passwords
- rmc 14y agoYou can do this if you, like LinkedIn, store SHA1 unsalted passwords. You just look for matches.
- slig 14y agoGoogle once forced a password reset for emails/passwords that leaked from a bitcoin forum.
- kristofferR 14y agoThat's easy to do it you have the email addresses, but impossible to do if you only have the SHA-1 hash, as in this case (unless you're also using unsalted SHA-1 hashes, which is a much bigger issue by itself).
- slig 14y agoYes, it's technically easy, but it shows everyone how much Google cares.
- jcfrei 14y agoi agree, but think about the backlash this would create amongst the userbase. the majority of the users will probably never even realize / read that their passwords have been stolen and thus linkedin probably does best in keeping a low profile about this (and start from now on using a better encryption). this is obviously not in the interest of the users, but it is in the interest of linkedin.
- aqme28 14y agoBetter Guy Startup Founder would be using salted hashes anyway and wouldn't even be able to run a cross-reference.
- nnnnnnnn 14y agoIt's possible to test this when your user re-authenticates, assuming you're not using a challenge-response authentication mechanism (as sadly most sites do not).
- john-n 14y agoInterestingly, linkedin did just that whe the gawker list was leaked (iirc).
- philfreo 14y agoFunny, LinkedIn was one of the few services that made me do this after the Gawker fiasco