4 ms·
Linkedin still has no idea how the attackers got their hands on the passwords. What if the backdoor is still open? The primary issue here is that the passwords
by akkartik 14y ago
Linkedin still has no idea how the attackers got their hands on the passwords. What if the backdoor is still open?
The primary issue here is that the passwords are hashed unsalted, not that they've exited the building.
- chc 14y agoHow is the lack of a salt the problem? AFAIK, all salts do is head off rainbow table attacks. If you're using SHA1 and you lose the passwords, a salt isn't going to help you, because they don't need to rainbow table you — they can use a dictionary attack or just brute force the passwords without much trouble. It seems to me that losing the passwords was the real problem, and it's compounded by a poor choice of hashing algorithm and lack of a salt. Lack of a salt is not good, but I don't see how it's worse than losing them in the first place. If they'd used bcrypt or not lost the passwords, a rainbow table wouldn't be useful in the first place.
- akkartik 14y agoI don't understand your line of reasoning. Aren't rainbow tables just another kind of brute force attack? They just allow you to share the brute force across a large number of passwords. Salts increase the effective length of the password, and per-password salts eliminate rainbow tables and make brute forcing harder as well. What am I missing? --- Linkedin now says their passwords are salted, so we could change our passwords now even if I was right. But they're also claiming that all passwords are now salted. http://blog.linkedin.com/2012/06/06/linkedin-member-passwords-compromised http://blog.linkedin.com/2012/06/06/linkedin-member-password... In any case, I'm enjoying this conversation, thanks.
- whichdan 14y agoI wonder how they're salting their current database. sha1(sha1(pass) + salt)?
- akkartik 14y agoHere's a far better response: http://queue.acm.org/detail.cfm?id=2254400 http://queue.acm.org/detail.cfm?id=2254400