3 ms·
My complex unique password is also on this list (full hash no 5 0's). So nope, not a hoax. Unbelievable/insulting they didn't even bother to salt.
by Yoms 14y ago
My complex unique password is also on this list (full hash no 5 0's). So nope, not a hoax. Unbelievable/insulting they didn't even bother to salt.
- jackalope 14y agoDo you remember when you first used this password at LinkedIn? It could help narrow the dates of the breach. Especially useful would be the presence of a strong password in the list that was subsequently changed. That might help determine its freshness, if the new password isn't present (although this may be an incomplete list from an ongoing breach).
- Yorn 14y agoI'm thinking this list is from closer to a year ago, I changed my password shortly after the MtGox hack last year and this hash is for my old password that was compromised during that time period.
- elektronaut 14y agoMy password is in the dump, and it was changed mid October 2010. I remember because I changed all my passwords when my laptop was stolen. The MtGox hack was in June 2011.
- Yoms 14y agoIt was about a year ago now. I checked the hashes for my previous password and it wasn't on the list... Mind you, as many have noticed, it seems to be very incomplete.
- deleted 14y ago[deleted]
- re_todd 14y agoYeah, even I, a newbie Rails programmer, going through the Agile Rails book learned how to salt. It isn't rocket science.
- jaaron 14y agoIt shouldn't just be a salt. It should be bcrypt.
- dudus 14y agoI couldn't find my password on the list and I've been using the same password for LinkedIn since I registered. I was trying to remember when was that. If someone know how to find out the last time you changed your pass or when you registered for linkedIn please let me know. I'd guess I use linkedIn for over 4 years at least.
- rodw 14y agoA "member since" date is available on the "Account & Settings" page. Choose "settings" in the drop down that appears when you hover over your (account) name in the upper right corner of any LinkedIn page.
- SkyMarshal 14y agoUnbelievable/insulting they used a general purpose, easily reversible hash like SHA1 in the first place. I would have thought everyone had seen the 'use bcrypt' page by now. http://codahale.com/how-to-safely-store-a-password/ http://codahale.com/how-to-safely-store-a-password/
- Nitramp 14y agoSince when is SHA1 easily reversible? Did I not get the memo? Salting should have been fine.