LeakedIn.org - check if your password was leaked

[Sysman]

I bet "correct horse battery staple" is now a fairly common password, especially on tech sites.

Yep.

Sad, isn't it?

If I was running a system with a black list of passwords not allowed, I'd have already added that one.

[NickFitz]

Also pasting your password into a random site to check if it has been leaked is idiotic.

Blindly condemning the use of the site out of pure ignorance when you could confirm that it's safe to use in about five seconds is idiotic.

[doodab]

I need several now. Mine hasn't - well, hadn't - yet been cracked, but it can't be trusted anymore now the hash is out there and associated with an email address at my domain, even though I use a separate email address for LinkedIn.

At least it wasn't the password I use for important stuff like banking, GMail, and CUK

I ran a few of my oft used ones through and it was 50/50 whether they are in there, including the linkedin one, so it looks like I'm just not that original. I suppose I'll have to come up with some new, better, ones and go on a changing frenzy at the weekend. It'll give me an excuse to take my new laptop to the coffee shop.

[AtW]

They should try to hash the hashes and they'll get more passwords cracked...

[doodab]

This one looks pretty safe and easy to remember

18a25cb38dcc89b50f5149d33f744be8f948affc

[MarillionFan]

Blindly condemning the use of the site out of pure ignorance when you could confirm that it's safe to use in about five seconds is idiotic.

Hey bit harsh.

I've checked Russels password for him. I typed in 'TotalCretin' and yes it appears he's been hacked.

[Platypus]

Chris Shiflett and friends have got the password hash dump and have set up a site where you can see if you're in there, and if your password had been cracked at the time the dump was produced: LeakedIn: Is your password safe?

Chris is well-known in the web development community (he's published a couple of books on web site security too) so his site can be trusted, but if you don't want to take his word for it, the site allows you to enter the SHA1 hash of your password instead. If you enter your actual password they SHA1 hash it anyway with JavaScript before sending it (I've checked and this does happen; if you use NoScript or similar remember to enable JS on the site first), so either way you won't be disclosing your password to them.

Mine is in there

Thank you Nick. Mine isn't there, but I changed it this morning when I heard the news, plus a couple of other places where I use the same password (silly me).

Post of the Day !

[NickFitz]

Thank you Nick. Mine isn't there, but I changed it this morning when I heard the news, plus a couple of other places where I use the same password (silly me).

Post of the Day !

HTH

[xoggoth]

none of the things I used that password for are so important that it matters

Same here. I always use different passwords for bank etc and same old one for unimportant things like Facebook, Linkedin or CUK. Hang on though, you mean somebody could sign into CUK as us and post a load of old rubbish? Horrors!

[d000hg]

I can't remember unique passwords per site and don't want to store passwords somewhere with a master key - just too much of a PITA.

However I am considering about using the same basic password, somehow 'salted' based on the website name.
e.g. passwordcontractoruk,passwordgmail,passwordhsbc etc. From what I understand of hashing and salting this would be secure since a)if they store hashed passwords any cahnge makes the hash different b)even if they stored plaintext passwords, it would require a human agent to manually inspect the hacked passwords and understand them, which I doubt would happen.