4 ms·
I don't understand your concern. How would it hurt if you're now using a different password from the list? If they don't know it's associated with your account,
by chc 14y ago
I don't understand your concern. How would it hurt if you're now using a different password from the list? If they don't know it's associated with your account, the only way they'd be able to use a password from the list to access your account is by trying all the passwords from the list in a dictionary attack. So in the worst case, you change your password from one that is definitely susceptible to a dictionary attack and possibly flat-out compromised to one that may or may not be susceptible to a dictionary attack.
In short, no, "Change your password" doesn't seem like bad advice to me.
- deleted 14y ago[deleted]
- akkartik 14y agoLinkedin still has no idea how the attackers got their hands on the passwords. What if the backdoor is still open? The primary issue here is that the passwords are hashed unsalted, not that they've exited the building.
- chc 14y agoHow is the lack of a salt the problem? AFAIK, all salts do is head off rainbow table attacks. If you're using SHA1 and you lose the passwords, a salt isn't going to help you, because they don't need to rainbow table you — they can use a dictionary attack or just brute force the passwords without much trouble. It seems to me that losing the passwords was the real problem, and it's compounded by a poor choice of hashing algorithm and lack of a salt. Lack of a salt is not good, but I don't see how it's worse than losing them in the first place. If they'd used bcrypt or not lost the passwords, a rainbow table wouldn't be useful in the first place.
- akkartik 14y agoI don't understand your line of reasoning. Aren't rainbow tables just another kind of brute force attack? They just allow you to share the brute force across a large number of passwords. Salts increase the effective length of the password, and per-password salts eliminate rainbow tables and make brute forcing harder as well. What am I missing? --- Linkedin now says their passwords are salted, so we could change our passwords now even if I was right. But they're also claiming that all passwords are now salted. http://blog.linkedin.com/2012/06/06/linkedin-member-passwords-compromised http://blog.linkedin.com/2012/06/06/linkedin-member-password... In any case, I'm enjoying this conversation, thanks.
- whichdan 14y agoI wonder how they're salting their current database. sha1(sha1(pass) + salt)?
- akkartik 14y agoHere's a far better response: http://queue.acm.org/detail.cfm?id=2254400 http://queue.acm.org/detail.cfm?id=2254400