4 ms·

I disagree with #5, I had a few of my coworkers check their sha1 against the DB and most of them were not in the dump. I also checked for truncated hashed, none

by madmaze 14y ago

I disagree with #5, I had a few of my coworkers check their sha1 against the DB and most of them were not in the dump. I also checked for truncated hashed, none of which were found. I have the feeling this is a subset of the full database

madmaze 14y ago
on another note, my fairly complex alphanumeric+symbol password IS in the dump, though not prepended truncated with 0's and the other one I found, which my coworker admitted was too short and alpha only, was in the dump with prepended 0's. This could validate the fact that the truncated hashes are actually already cracked.
- nupark2 14y ago
  Mine was 5 characters, alpha and numeric, but no special characters. It was in there, prepended with 0's. Whoops. At the very least, it should have been longer.
  - tomh 14y ago
    Same here - mine was all alpha characters, seven characters, and the hash with five 0's was in the file. Guess who just changed their LinkedIn password today? And included some numbers?
barik 14y ago
I don't really see a purpose in hiding my password. So, as a counterpoint, my password is in the list. This is my LinkedIn password: AxEWS9rg5V This is the sha1: caf28fcc9c3e4d88b830b8e5cc52c5b65d3db5f4 It is found in Line 3612910 of combo_not.txt. I believe the file is authentic.
ddlatham 14y ago
Another datum: the hash of my password (randomly generated 8 character mixed case alphanumeric) was in the file, without any overwritten 0's.
leot 14y ago
Mine is there. (email me if you need proof)
daurnimator 14y ago
My linkedin password of at least 3 years was not in the dump. So it must be a partial...
yesbabyyes 14y ago
My password is in the dump. I use the Forget Passwords Chrome extension [1], which is based on pwdhash.com, and generate site-specific passwords based on a master password -- i.e. my password is only used on LinkedIn and it's unlikely that I share it with someone else. I think I have changed to this password during the last year.
jen_h 14y ago
So I have a funny wild theory...remember back when the Gawker database was compromised? And LinkedIn forced a password reset for users who (according to what I read) used email addresses that matched the Gawker leak? What if they also (or actually) compared password hashes from their database to the ones released in the Gawker breach? In that case, they likely wouldn't have pulled data straight from the database but actually might have pulled passes from the db, output to text files, cut the text files up to parcel out for processing via Hadoop or something? And somehow one of those text files got loose somehow...or someone MiTMed the actual process (I'd vote for a floating text file just because it's been so long; the Gawker breach was in December 2010).

by madmaze 14y ago

madmaze 14y ago

on another note, my fairly complex alphanumeric+symbol password IS in the dump, though not prepended truncated with 0's and the other one I found, which my coworker admitted was too short and alpha only, was in the dump with prepended 0's. This could validate the fact that the truncated hashes are actually already cracked.

nupark2 14y ago
Mine was 5 characters, alpha and numeric, but no special characters. It was in there, prepended with 0's. Whoops. At the very least, it should have been longer.
- tomh 14y ago
  Same here - mine was all alpha characters, seven characters, and the hash with five 0's was in the file. Guess who just changed their LinkedIn password today? And included some numbers?

barik 14y ago

I don't really see a purpose in hiding my password. So, as a counterpoint, my password is in the list. This is my LinkedIn password: AxEWS9rg5V This is the sha1: caf28fcc9c3e4d88b830b8e5cc52c5b65d3db5f4 It is found in Line 3612910 of combo_not.txt. I believe the file is authentic.

ddlatham 14y ago

Another datum: the hash of my password (randomly generated 8 character mixed case alphanumeric) was in the file, without any overwritten 0's.

leot 14y ago

Mine is there. (email me if you need proof)

daurnimator 14y ago

My linkedin password of at least 3 years was not in the dump. So it must be a partial...

yesbabyyes 14y ago

My password is in the dump. I use the Forget Passwords Chrome extension [1], which is based on pwdhash.com, and generate site-specific passwords based on a master password -- i.e. my password is only used on LinkedIn and it's unlikely that I share it with someone else. I think I have changed to this password during the last year.

jen_h 14y ago

So I have a funny wild theory...remember back when the Gawker database was compromised? And LinkedIn forced a password reset for users who (according to what I read) used email addresses that matched the Gawker leak? What if they also (or actually) compared password hashes from their database to the ones released in the Gawker breach? In that case, they likely wouldn't have pulled data straight from the database but actually might have pulled passes from the db, output to text files, cut the text files up to parcel out for processing via Hadoop or something? And somehow one of those text files got loose somehow...or someone MiTMed the actual process (I'd vote for a floating text file just because it's been so long; the Gawker breach was in December 2010).