6 ms·

LastPass - LinkedIn Password Checker

45 points by dous 14y ago

51Cards 14y ago
Same functionality as http://leakedin.org/ http://leakedin.org/ ? http://news.ycombinator.com/item?id=4075347 http://news.ycombinator.com/item?id=4075347
- jcdavis 14y ago
  For starters, lastpass is using https, which is definitely better
  - shawabawa 14y ago
    Not really. It's only sending the hash of your password, not your password in plaintext. Although the hashes don't seem to be salted...
  - pwman 14y ago
    https, we're not using 'GET' parameters for the hash (which is almost certainly ending up in log files on leakedin's site). We also just came out with a version for eHarmony's breach: https://lastpass.com/eharmony/ https://lastpass.com/eharmony/
    - rpicard 14y ago
      Completely off-topic but am I the only one that has been having problems viewing secure notes on FF 13? I can view them once every time I start Firefox but after that they just don't pop-up.
      - pwman 14y ago
        Try the prebuild: https://lastpass.com/dlpre https://lastpass.com/dlpre
cheeze 14y ago
Other one is prettier.
- jurre 14y ago
  But I'm more inclined to send last pass my old password to be honest.
lucb1e 14y ago
I can't understand the rationale behind tricking people into thinking this is secure. - A list of (partial) hashes was released - People start setting up websites where you can compute your hash, this is already a bit dubious - Now people start setting up websitse where you can check if your password was stolen, effectively sending them a copy of your hash to make sure they got it... It would not surprise me if one of those tools turn out to also send your unhashed password along.
- route66 14y ago
  More than that it "educates" people that entering their password into some web form other than the original login page is ok. Because the site says so.
  - lucb1e 14y ago
    Indeed, also a very good point.
dchest 14y ago
This is useless. How do you know they released the full dump? The best "password checker" is the one that says you to change your password.
Eeko 14y ago
I wrote a FB-note for my buddies regarding these tools and the leak. I see a lot of bad advice on HN as well, so I should probably paste how I see it here as well: 1. DO NOT check whether or not your password was compromised via services like leakedin.org. If you've used LinkedIn, it was stolen. They only RELEASED around 6 million passwords, though LinkedIn has 161 million users. Odds are, your password is not found from the publicized list. There's very little reason to assume, that those password-hashes were the only ones out there... By using such services, you just guarantee that your password-hash ends up in a web-server log to be stolen or outright to a hash-dictionary. Especially since most of us are stupid and recycle passwords from other services, you'll just intentionally leak your weak password to a 3rd party. (Besides, leakedin.org DOES leak that information to a third party. They use an analytic tool, getclicky.com, which commits your search parameters back home every time you do a page reload/search.) 2. As far as we know, LinkedIn HAS NOT DISCOVERED HOW THE ATTACK WAS MADE NOR BLOCKED THE VULNERABILITY. So even though we've all been clever and changed our passwords before any damages were done, the new one might as well have been leaked already. This is especially bad, if the new password is a recycled password as well. So if you lost your LinkedIn & Gmail -password before and replaced it with your FB-password... Congratulations! Odds are that you lost your FB-password as well. Also, change your password again once LinkedIn has given a statement of fixing the vulnerability. If they don't... Well, sell your NYSE:LNKD. 3. For every leak we know of, there's dozens of leaks we don't. Assume that your password gets stolen. Don't recycle them. Use a Password Manager (I use 1Password, there are others, cheaper and free ones, though. Don't know how good they are.) and/or a system such as passphrases or http://safeandsavvy.f-secure.com/2010/03/15/how-to-create-and-remember-strong-passwords/ http://safeandsavvy.f-secure.com/2010/03/15/how-to-create-an... . 4. People can do pretty evil things with your data and by being able to impersonate you. Your account can be used to scam people (you might not want legal trouble), to blackmail you, to spy on you and your neighbors or even for performing crimes. E.g. Money laundering. (https://www.facebook.com/notes/eetu-korhonen/about-the-linkedin-thing/10150925856481878 https://www.facebook.com/notes/eetu-korhonen/about-the-linke...)
- Tooluka 14y ago
  You don't believe Lastpass privacy statement but still use and believe Facebook?
jgrahamc 14y ago
I think LinkedIn handled this very badly: http://blog.jgc.org/2012/06/dont-be-reckless-with-other-peoples.html http://blog.jgc.org/2012/06/dont-be-reckless-with-other-peop...
sakri 14y ago
That was somewhat amusing. Somebody had "dingleberry" as their password :)
superxor 14y ago
LastPass is an excellent service to manage your passwords. Their Firefox add-on is amazing. If you are not the paranoid-type (i.e. not scared to put your passwords in a 3rd party cloud) then I strongly recommend LastPass. Their browser add-ons are free and their mobile apps a mere 1$.
- elithrar 14y ago
  > 1. DO NOT check whether or not your password was compromised via services like leakedin.org. If you've used LinkedIn, it was stolen. They only RELEASED around 6 million passwords, though LinkedIn has 161 million users. Odds are, your password is not found from the publicized list. There's very little reason to assume, that those password-hashes were the only ones out there... Correction: 6.5 million hashes, which most definitely comprise more than 6.5 million users once commonly used passwords are accounted for. Of course, we are both making assumptions, but it is not accurate to say it is only 6.5m users (just yet).
- josephb 14y ago
  LastPass don't store your passwords per se. Your passwords are SHA256 hashed locally. I love their system, but I think LastPass don't do a good enough job of explaining the security behind the system to those who are a bit more skeptical.
- epo 14y ago
  A mere $1 "per month".
Vadoff 14y ago
What's interesting is that virtually every single number spelled out from "eleven" to "onehundred" is used as a password. I've also noticed celebrities are really common, such as "parishilton", "michaeljackson", or "jamescameron".
Gigel 14y ago
Why nobody mentions that the hackers probably have also your username, which on LinkedIn is a valid e-mail address ?
kator 14y ago
This is great fun to play with.. Some of the most amazing stupid passwords you can imagine are in here. Including things like qazwsx or 1q2w3e4r etc. Lot's of "keyboard patterns" etc. Maybe major sites should use these sorts of lists as black lists for passwords? Of course the sad thing is then someone gets pissed while registering and will just click away because the first 20 passwords they thought up are already in there. :) It's a fine balance and one that's not going to die anytime soon.
- kator 14y ago
  Has anyone thought of doing a keyboard heatmap for this list? It seems to me there are a lot of these "muscle memory" like passwords in here where people use the keyboard pattern as the password basically.
ashaikh 14y ago
There are some hilarious passwords listed, just keep entering combinations of profanity to see. f*you is there etc.
- Angostura 14y ago
  At least they let you. My LinkedIn password was also used for a rather old, unimportant POP account. So I went into Viginmedia account settings to change it. Not only does Virgin enforce a maximum password length of 10 (what?!) this fact also lead me to discover that the company has a profanity filter on its passwords. (Double what!?)
  - RossM 14y ago
    What a clbuttic mistake.
  - dewiz 14y ago
    That might be because there are situations where they would ask for your password on the phone... ;-)
dewiz 14y ago
I've been using LastPass for years and their service is great, so I decided to trust this service too. Apparently (if the published list is complete) my (old) password hash was not hacked :-)
kevinpet 14y ago
I think the story here is: company that offers a password vault product thinks it's a good idea to encourage users to enter their passwords in third-party websites.

45 points by dous 14y ago

Same functionality as http://leakedin.org/ http://leakedin.org/ ? http://news.ycombinator.com/item?id=4075347 http://news.ycombinator.com/item?id=4075347

jcdavis 14y ago
For starters, lastpass is using https, which is definitely better
- shawabawa 14y ago
  Not really. It's only sending the hash of your password, not your password in plaintext. Although the hashes don't seem to be salted...
- pwman 14y ago
  https, we're not using 'GET' parameters for the hash (which is almost certainly ending up in log files on leakedin's site). We also just came out with a version for eHarmony's breach: https://lastpass.com/eharmony/ https://lastpass.com/eharmony/
  - rpicard 14y ago
    Completely off-topic but am I the only one that has been having problems viewing secure notes on FF 13? I can view them once every time I start Firefox but after that they just don't pop-up.
    - pwman 14y ago
      Try the prebuild: https://lastpass.com/dlpre https://lastpass.com/dlpre

cheeze 14y ago

Other one is prettier.

jurre 14y ago
But I'm more inclined to send last pass my old password to be honest.

lucb1e 14y ago

I can't understand the rationale behind tricking people into thinking this is secure. - A list of (partial) hashes was released - People start setting up websites where you can compute your hash, this is already a bit dubious - Now people start setting up websitse where you can check if your password was stolen, effectively sending them a copy of your hash to make sure they got it... It would not surprise me if one of those tools turn out to also send your unhashed password along.

route66 14y ago
More than that it "educates" people that entering their password into some web form other than the original login page is ok. Because the site says so.
- lucb1e 14y ago
  Indeed, also a very good point.

dchest 14y ago

This is useless. How do you know they released the full dump? The best "password checker" is the one that says you to change your password.

Eeko 14y ago

I wrote a FB-note for my buddies regarding these tools and the leak. I see a lot of bad advice on HN as well, so I should probably paste how I see it here as well: 1. DO NOT check whether or not your password was compromised via services like leakedin.org. If you've used LinkedIn, it was stolen. They only RELEASED around 6 million passwords, though LinkedIn has 161 million users. Odds are, your password is not found from the publicized list. There's very little reason to assume, that those password-hashes were the only ones out there... By using such services, you just guarantee that your password-hash ends up in a web-server log to be stolen or outright to a hash-dictionary. Especially since most of us are stupid and recycle passwords from other services, you'll just intentionally leak your weak password to a 3rd party. (Besides, leakedin.org DOES leak that information to a third party. They use an analytic tool, getclicky.com, which commits your search parameters back home every time you do a page reload/search.) 2. As far as we know, LinkedIn HAS NOT DISCOVERED HOW THE ATTACK WAS MADE NOR BLOCKED THE VULNERABILITY. So even though we've all been clever and changed our passwords before any damages were done, the new one might as well have been leaked already. This is especially bad, if the new password is a recycled password as well. So if you lost your LinkedIn & Gmail -password before and replaced it with your FB-password... Congratulations! Odds are that you lost your FB-password as well. Also, change your password again once LinkedIn has given a statement of fixing the vulnerability. If they don't... Well, sell your NYSE:LNKD. 3. For every leak we know of, there's dozens of leaks we don't. Assume that your password gets stolen. Don't recycle them. Use a Password Manager (I use 1Password, there are others, cheaper and free ones, though. Don't know how good they are.) and/or a system such as passphrases or http://safeandsavvy.f-secure.com/2010/03/15/how-to-create-and-remember-strong-passwords/ http://safeandsavvy.f-secure.com/2010/03/15/how-to-create-an... . 4. People can do pretty evil things with your data and by being able to impersonate you. Your account can be used to scam people (you might not want legal trouble), to blackmail you, to spy on you and your neighbors or even for performing crimes. E.g. Money laundering. (https://www.facebook.com/notes/eetu-korhonen/about-the-linkedin-thing/10150925856481878 https://www.facebook.com/notes/eetu-korhonen/about-the-linke...)

Tooluka 14y ago
You don't believe Lastpass privacy statement but still use and believe Facebook?

jgrahamc 14y ago

I think LinkedIn handled this very badly: http://blog.jgc.org/2012/06/dont-be-reckless-with-other-peoples.html http://blog.jgc.org/2012/06/dont-be-reckless-with-other-peop...

sakri 14y ago

That was somewhat amusing. Somebody had "dingleberry" as their password :)

superxor 14y ago

LastPass is an excellent service to manage your passwords. Their Firefox add-on is amazing. If you are not the paranoid-type (i.e. not scared to put your passwords in a 3rd party cloud) then I strongly recommend LastPass. Their browser add-ons are free and their mobile apps a mere 1$.

elithrar 14y ago
> 1. DO NOT check whether or not your password was compromised via services like leakedin.org. If you've used LinkedIn, it was stolen. They only RELEASED around 6 million passwords, though LinkedIn has 161 million users. Odds are, your password is not found from the publicized list. There's very little reason to assume, that those password-hashes were the only ones out there... Correction: 6.5 million hashes, which most definitely comprise more than 6.5 million users once commonly used passwords are accounted for. Of course, we are both making assumptions, but it is not accurate to say it is only 6.5m users (just yet).
josephb 14y ago
LastPass don't store your passwords per se. Your passwords are SHA256 hashed locally. I love their system, but I think LastPass don't do a good enough job of explaining the security behind the system to those who are a bit more skeptical.
epo 14y ago
A mere $1 "per month".

Vadoff 14y ago

What's interesting is that virtually every single number spelled out from "eleven" to "onehundred" is used as a password. I've also noticed celebrities are really common, such as "parishilton", "michaeljackson", or "jamescameron".

Gigel 14y ago

Why nobody mentions that the hackers probably have also your username, which on LinkedIn is a valid e-mail address ?

kator 14y ago

This is great fun to play with.. Some of the most amazing stupid passwords you can imagine are in here. Including things like qazwsx or 1q2w3e4r etc. Lot's of "keyboard patterns" etc. Maybe major sites should use these sorts of lists as black lists for passwords? Of course the sad thing is then someone gets pissed while registering and will just click away because the first 20 passwords they thought up are already in there. :) It's a fine balance and one that's not going to die anytime soon.

kator 14y ago
Has anyone thought of doing a keyboard heatmap for this list? It seems to me there are a lot of these "muscle memory" like passwords in here where people use the keyboard pattern as the password basically.

ashaikh 14y ago

There are some hilarious passwords listed, just keep entering combinations of profanity to see. f*you is there etc.

Angostura 14y ago
At least they let you. My LinkedIn password was also used for a rather old, unimportant POP account. So I went into Viginmedia account settings to change it. Not only does Virgin enforce a maximum password length of 10 (what?!) this fact also lead me to discover that the company has a profanity filter on its passwords. (Double what!?)
- RossM 14y ago
  What a clbuttic mistake.
- dewiz 14y ago
  That might be because there are situations where they would ask for your password on the phone... ;-)

dewiz 14y ago

I've been using LastPass for years and their service is great, so I decided to trust this service too. Apparently (if the published list is complete) my (old) password hash was not hacked :-)

kevinpet 14y ago

I think the story here is: company that offers a password vault product thinks it's a good idea to encourage users to enter their passwords in third-party websites.