Security is paramount

[NickFitz]

Details of the LinkedIn Hash Brute-Force

One thing they don't mention there is that already-cracked hashes in the dumps have the first five characters set to zero, so you have to check for that too.

[Sysman]

One thing they don't mention there is that already-cracked hashes in the dumps have the first five characters set to zero, so you have to check for that too.

Even that has been addressed

One issue becomes apparent: about half the file has had the first 5 characters zeroed out. This is discussed at ycombinator. Atom has released a version of his Hashcat password cracker to deal with this. John-the-Ripper apparently also has published a patch for this.

...

So let's try the other file containing the corrupted hashes using the updated Hashcat feature on the other file, containing all the zeroed-out hashes.

As you can see, this straight dictionary lookup results in 688-thousand passwords being cracked, or about one fifth of all the zeroed hashes.

It gets worse when the guy starts using GPU processing. Worth a read.

[NickFitz]

Even that has been addressed



It gets worse when the guy starts using GPU processing. Worth a read.

Good article