Reply to: LeakedIn.org - check if your password was leaked

[Sysman]

Not but if you get 100 hashes the same with come back to "thisismypassword" then its worth spending the time to crach that rather than gYJKaJkaJhaquz which is likley auto generated and just for this site.

That makes sense. Someone who makes the effort to generate a long meaningless password is probably paranoid enough to have a unique password per site.

It isn't just the site that gets attacked that is the target. Other sites where you use the same username and password might result in richer pickings.

Gawker

Gawker got into a pissing match with Anonymous. Anonymous spent a little time and managed to pull the full source code for their CMS (ganja) and also the entire 1.3M record user database. They released it as a torrent.

Gawker Hack Exposes Ridiculous Password Habits.

I recall reading at the time that the Gawker chap responsible for the pissing contest was found to be using the same password across multiple accounts.

Oh Dear.

[lilelvis2000]

Mine's okay, I tried 'password' and apparently leaked. Just how many people have 'password' as their password!

[Sockpuppet]

WTF?

They've cracked my password! Looks like I'll have to change it from Marill10nF4n!54F@b45tard01 to Marill10nF4n!54F@b45tard02

Not but if you get 100 hashes the same with come back to "thisismypassword" then its worth spending the time to crach that rather than gYJKaJkaJhaquz which is likley auto generated and just for this site.

[NotAllThere]

First time I've seen a moderator on a forum dishing out insults...

As a moderator, I'll never insult you. As a member, I'm happy to say I think you're unobservant as well as bit silly.

[SupremeSpod]

I have a feeling they'll only try to crack your password if it appeared on the list more than once. After all some of my passwords are almost SHA1 hashes themselves.

No point trying to crack that when its likley it'll be unique to LinkedIn but finding 4 users with the same hash is different.

WTF?

They've cracked my password! Looks like I'll have to change it from Marill10nF4n!54F@b45tard01 to Marill10nF4n!54F@b45tard02

[Sockpuppet]

I have a feeling they'll only try to crack your password if it appeared on the list more than once. After all some of my passwords are almost SHA1 hashes themselves.

No point trying to crack that when its likley it'll be unique to LinkedIn but finding 4 users with the same hash is different.

[russell]

Blindly condemning the use of the site out of pure ignorance when you could confirm that it's safe to use in about five seconds is idiotic.

So because you said it's safe or the guys who created said it's safe, or the Javascript looks ok to you, that means every other person can confirm it's safe in 5 seconds? Wait didn't you do work on this forum's code, and there were viruses etc on here, ll making sense now.

[Sockpuppet]

b)even if they stored plaintext passwords, it would require a human agent to manually inspect the hacked passwords and understand them, which I doubt would happen.

Unless they just post them online for tulips and giggles.

[d000hg]

I can't remember unique passwords per site and don't want to store passwords somewhere with a master key - just too much of a PITA.

However I am considering about using the same basic password, somehow 'salted' based on the website name.
e.g. passwordcontractoruk,passwordgmail,passwordhsbc etc. From what I understand of hashing and salting this would be secure since a)if they store hashed passwords any cahnge makes the hash different b)even if they stored plaintext passwords, it would require a human agent to manually inspect the hacked passwords and understand them, which I doubt would happen.

[xoggoth]

none of the things I used that password for are so important that it matters

Same here. I always use different passwords for bank etc and same old one for unimportant things like Facebook, Linkedin or CUK. Hang on though, you mean somebody could sign into CUK as us and post a load of old rubbish? Horrors!

[NickFitz]

Thank you Nick. Mine isn't there, but I changed it this morning when I heard the news, plus a couple of other places where I use the same password (silly me).

Post of the Day !

HTH

[Platypus]

Chris Shiflett and friends have got the password hash dump and have set up a site where you can see if you're in there, and if your password had been cracked at the time the dump was produced: LeakedIn: Is your password safe?

Chris is well-known in the web development community (he's published a couple of books on web site security too) so his site can be trusted, but if you don't want to take his word for it, the site allows you to enter the SHA1 hash of your password instead. If you enter your actual password they SHA1 hash it anyway with JavaScript before sending it (I've checked and this does happen; if you use NoScript or similar remember to enable JS on the site first), so either way you won't be disclosing your password to them.

Mine is in there

Thank you Nick. Mine isn't there, but I changed it this morning when I heard the news, plus a couple of other places where I use the same password (silly me).

Post of the Day !

[MarillionFan]

Blindly condemning the use of the site out of pure ignorance when you could confirm that it's safe to use in about five seconds is idiotic.

Hey bit harsh.

I've checked Russels password for him. I typed in 'TotalCretin' and yes it appears he's been hacked.

[doodab]

This one looks pretty safe and easy to remember

18a25cb38dcc89b50f5149d33f744be8f948affc

[AtW]

They should try to hash the hashes and they'll get more passwords cracked...