LinkedIn forcing password resets due to Gawker hack

http://www.centernetworks.com/linkedin-forcing-all-passwords-to-change

by moses1400 • 16 years ago

41 38 16 years ago

centernetworks.com

forkqueue• 16 years ago

And no doubt the phishers are already cooking up emails to this effect too...

joezydeco• 16 years ago

Got an email from mint.com long after I closed that account, asking me to verify a bank connection that wasn't working.

Headers look legit, but man things like these are going to bite people hard.

user24• 16 years ago

I was really impressed about this. I changed most of my other password but forgot about LinkedIn. I think it's really responsible of them to proactively take the initiative on this.

thenduks3• 16 years ago

The most interesting thing about this to me is that they're obviously only emailing people who's emails were in the gawker data. Eg: I didn't receive one of these because I don't have a gawker account. Very cool.

sbhat7• 16 years ago

This would also mean they downloaded the copy of gawker's hacked database, which is probably why they didn't provide more details.

thenduks3• 16 years ago

Definitely a possibility. There are some alternatives now though, like the list[1] of MD5'd emails that has been circulating that you can use to check against. That's how I confirmed that I wasn't in there, personally.

[1] http://www.google.com/fusiontables/DataSource?dsrcid=350662

tzs• 16 years ago

I apparently have a gawker account, because I received an email from gawker telling me about the breach. This surprised me because I did not remember ever making a gawker account, and I have no entries for any gawker site in 1Password as far as I can see.

Checking the supposedly full database that the hackers released, the email address gawker mailed to is not there (nor are any other email addresses of mine).

I have not received an email from LinkedIn (yet), but when I attempted to log in to it a few minutes ago, it failed and told me there was a problem with my account. I just tried again and this time it takes me to a page that says they have been notified there is a problem with my account and they are fixing it and I'll be taken to my home page in a few minutes.

Net result: I am now very confused.

watty2• 16 years ago

I was not impressed by this. It would have been nice of LinkedIn to include a more specific reason for requiring a password reset other than "We have recently disabled your account for security reasons.". I was in panic mode this morning thinking that someone had gotten into my LinkedIn account (and email) and triggered my account to be locked.

brown9-2• 16 years ago

I had a very similar reaction - "is this because my email address was in the gawker database or because someone used my password from the gawker database and did weird things with my account?"

jedsmith• 16 years ago

The alternative is calling out Gawker. They probably shouldn't do that.

look_lookatme• 16 years ago

Exactly.

endtime• 16 years ago

Or just "Please update your password. This is just a precautionary measure; we do not believe your account to have been compromised."

tptacek3• 16 years ago

They were under absolutely no obligation to do this. Anyone could predict that some subset of their users would get pissy about it. They did it anyways because it was the right thing to do. My esteem for LinkedIn just grew by leaps.

watty2• 16 years ago

I wasn't pissy about them resetting my password, I was scared that my LinkedIn account and who knows what else had been compromised in relation to the Gawker incident.

It was a good move by LinkedIn to force a password reset. It would have been a GREAT move if they had told me it was precautionary instead of me having to guess why my account was locked.

sabat• 16 years ago

I agree -- I applaud the password reset, but would urge them to be specific about the reason, and the fact that this was a bulk action. At first I thought it was just me, and that someone was targeting my account(s). Needless worry could be avoided just by LinkedIn explaining its reasoning.

In contrast, here's the email I just got from Blizzard about my World of Warcraft (battle.net) account:

Greetings!

We’ve recently been informed that several Gawker Media websites have been compromised. These websites include Gawker, Gizmodo, Kotaku, Lifehacker, Jezebel, io9, Jalopnik, Deadspin, and Fleshbot. To help minimize the effects of this compromise and help keep your Battle.net account safe and secure, we’ve reset your account password. To complete the password reset, please log into Battle.net Account Management (https://us.battle.net/account/management) and follow the provided instructions.

ghurlman• 16 years ago

I had the opposite reaction - I'd already changed my password, and had thought that someone had tried to get in.

gmurphy• 16 years ago

Unfortunately for happiness, they reset my password after I'd already done so myself.

tallanvor• 16 years ago

Same here. I had taken this as an opportunity to change a bunch of passwords even though they weren't the same as the one I used on Gawker.

vladocar• 16 years ago

Yesterday I had to change my GMail & Twitter password, today I got mail from LinkedIn to change my password. What is going on!?

Update: If your md5(email) is on this list http://www.google.com/fusiontables/DataSource?dsrcid=350662 Google, Twitter, LinkedIn and probably other sites will ask you to change(reset) your password.

That happened to me.

whakojacko2• 16 years ago

Interestingly enough, my former LinkedIn email was on the Gawker list but my current email with them (to which they sent the alert) was not. Guess that means they are holding on to all previous email accounts?

gregschlom• 16 years ago

Yes they are, and they are even keeping track and which of those email account are bouncing back.

See: https://www.linkedin.com/secure/settings?emadd=&goback=....

whakojacko2• 16 years ago

But I went even further, deleting my old email address from that list several months ago. That page only shows my (current) email, which was not on the Gawker list. LinkedIn seems to be keeping around the old email addresses, even after you delete them.

streety• 16 years ago

They also seem to be sending out emails to all the email addresses they have on file. I ended up with four copies of the same message.

brunoqc• 16 years ago

Blizzard did it too for the battle.net thing.

rufo• 16 years ago

Yes, as well as an explanatory note so you knew exactly what was going on - while I appreciate the sentiment, I wish LinkedIn would've done the same.

siddhant• 16 years ago

Looks the same to me. Is it only for the premium accounts?

lylejohnson• 16 years ago

No, I got the email and I don't have a premium account.

ojbyrne• 16 years ago

As people have mentioned above, it seems to have only been for people whose emails were in the gawker dump.

clark• 16 years ago

LinkedIn is one of the sites that limit the length of your password and what it can maintain. I've emailed their staff many times, and they simply respond that those are the password restrictions.

nodata• 16 years ago

Did the staff respond with _why_ those are the password restrictions?

cookiecaper2• 16 years ago

I think it's a little silly to force this site-wide. In my experience, most people don't make accounts to comment on tech blogs, and those that do are probably already privvy to the need to change a password when a big database of passwords containing or potentially containing your password is released.

I think it is weird for big companies to act like this has such far-reaching effects; 1.5 million users is not that many in the overall scheme of things, and how many of your users intersect? Apparently LinkedIn thinks that most business people who read that a LinkedIn account would make employers think you were smart and cool also had an account with the same credentials at Gawker.

tptacek3• 16 years ago

Huh? They have a list of email addresses for which passwords were disclosed. If your email address was on the list and you held a LinkedIn account, they zeroed out your password and made you reset it. They didn't reset everyone's account, did they?

cookiecaper2• 16 years ago

My understanding was that they had reset everyone's account. I don't think it was defined or not in the article. If they haven't reset everyone's account, disregard my comment, sorry for the misunderstanding. :)

jamesjyu• 16 years ago

And now it seems like they are down, just after I reset my password: http://img.skitch.com/20101214-jk1wagxdf1kn4af4eq9tw2s4na.jp...

Something about this makes me feel nervous..

gkelly• 16 years ago

I'm not getting any outage messages, but when I submit the new password form, I get "An unexpected error has occured." And my new password doesn't work, so I'm still locked out.

dlnovell• 16 years ago

Is LinkedIn completely down for anyone else? The site's been devolving all afternoon for me. First it said there was a problem and they'd redirect to the homepage in a few minutes. Then there was a LinkedIn-branded Sun ONE Web Server landing page that just had features of ONE for the last hour or so. I just checked back and now it's a totally stock landing page without the linkedin logo. Something seems to be seriously FUBAR today.

LinkedIn forcing password resets due to Gawker hack

Related Stories