LeakedIn

http://leakedin.org/

by ams1 • 14 years ago

253 174 14 years ago

leakedin.org

jharding• 14 years ago

You should add a note on the page that lets people know that checking a password takes a minute or two.

EDIT: Actually never mind, seems like it's much faster now.

scoates• 14 years ago

Yeah. We got hit pretty hard. It doesn't actually take a minute or two, unless you're doing a few hundred at the same time. Fixing. (-:

mythz• 14 years ago

Can you confirm you're not logging/recording the hashed passwords?

joshuahedlund3• 14 years ago

Mine was not in the list. I had a non-dictionary password with letters and numbers, 8 characters, and it was at least several months old.

(If we can collect enough data points of whose passwords are on it or not, how old they are, and how complex the password was, we should be able to narrow down a potential date range for the list and the odds that the compromised list is full or partial.)

epo• 14 years ago

You're confusing "not on the list" with "not in the hacker's possession".

joshuahedlund3• 14 years ago

Not necessarily. There are two possibilities we can analyze:

1. "not on the list" means "not in the hacker's possession". In other words, the compromised list is partial.

2. "not on the list" means hacker already has cracked it and didn't post for help.

Learning more about the kinds of passwords not on the list could help us determine which scenario is more likely. (If lots of complex passwords are not on the list, that is evidence the compromised list is partial. If only simple passwords or passwords of a certain pattern are not on the list, that is evidence the compromised list is complete and passwords that were already cracked were not posted.)

pbhjpbhj• 14 years ago

Don't all the hashes listed have "c3dxxxxx" at the end. They to me, at a glance, look like a partial.

Head:

    00000fac2ec84586f9f5221a05c0e9acc3d2e670
    0000022c7caab3ac515777b611af73afc3d2ee50
    deb46f052152cfed79e3b96f51e52b82c3d2ee8e
    00000dc7cc04ea056cc8162a4cbd65aec3d2f0eb
    00000a2c4f4b579fc778e4910518a48ec3d2f111
    b3344eaec4585720ca23b338e58449e4c3d2f628
    674db9e37ace89b77401fa2bfe456144c3d2f708

Tail:

    00000e585039977da2b9c4f28fc418b8c3d2d599
    a0cad23ffd750e306bd7be8cc695d2e6c3d2d67b
    d338c29d3918574f256fc0be597d2ee0c3d2d891
    00000ad7316592e01ce0aab1cc4339b1c3d2de0d
    00000c682336158bfcd57edfe4fab7acc3d2de28
    00000d77a7b62838c5f721b30e6ee8ecc3d2deb9
    00000def8fc887cd8e910823e98ae509c3d2dedc

facorreia2• 14 years ago

Exactly, because the hacker only posted the passwords he neede d help with.

simoncion• 14 years ago

My autogenerated password was not on the list. It was generated back in late 2010.

anonymoushn2• 14 years ago

My password of vhuwirbqr83fh83f was also not on the list

fendrak• 14 years ago

One suggestion: make the input box have a type of 'password'. I was only a bit put-off by seeing my plaintext password staring me in the face!

kungfooey• 14 years ago

Probably a good thing since it makes you think twice about submitting your plain-text password to an unknown entity.

sontek• 14 years ago

I think its safer to test yourself than randomly typing your password in on websites =)

jeffgreco• 14 years ago

You can provide your own hash, and a quick source check reveals that plaintext is being converted into a hash client-side, so only hashed data is being sent to the server.

thrill• 14 years ago

'password' was actually in use - go figure.

nailer• 14 years ago

I think it'd be best to provide people with a simple way to generate their hash with a well-known tool they already trust - eg, an openssl command.

artursapek• 14 years ago

Not like they couldn't save it as a variable if they wanted. That's just what you see in the UI.

pbreit• 14 years ago

Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.

jperras4• 14 years ago

You can supply just your password hash if you want, and if you supply the raw password, it's hashed client-side via Javascript before being sent to the server. Test it out with firebug and a dummy password if you're not keen on wading through the source.

paulhodge2• 14 years ago

Still, hashes can be cracked, and an evil password-checking website can then associate the password with all of the other personally-identifiable data that browsers are known to leak. I don't think this particular site is being evil, but it would be wrong for a user to trust a site like this.

raverbashing5• 14 years ago

What would be good is to have the 'checking request' return a json (or just a short info) and not a whole html

joshuahedlund3• 14 years ago

Even if you don't check the source code to verify that it's harmless, you should assume your password has been compromised and have already changed it anyway. This just lowers the cost of checking the list and could help us learn more about the compromise.

shuri• 14 years ago

If the hole that let them in hasn't been closed yet, changing the password will make that password vulnerable, right?

vibrunazo• 14 years ago

Just change your password before checking. You should've had already, anyway.

16s2• 14 years ago

My password is 'password1' and it's on that list... Yikes.

16s2• 14 years ago

You guys have no sense of humor.

samstave2• 14 years ago

hunter2

madsr• 14 years ago

correct horse battery staple.

raverbashing5• 14 years ago

In other news I have a startup on credit card security

Just submit your credit card number, CVV2 and expiration date and it'll check if it has been stolen over the internet for you

jyu• 14 years ago

Oh, I think I know you. You're that Nigerian prince I keep getting emails from, right?

slavak• 14 years ago

Will you be directing the form submission page to a static HTML page reading "Yes"?

awj• 14 years ago

Hate to say it, but someone executed on this before you: http://ismycreditcardstolen.com/

mrmaddog• 14 years ago

If you don't particularly trust the included click.js script, you can generate your password's SHA-1 via python fairly easily

   python -c 'import hashlib; print hashlib.sha1("PaSSw0rd").hexdigest()'

ibotty3• 14 years ago

or easier and shorter:

   printf PaSSw0rd | sha1sum

mhluongo2• 14 years ago

Add a `from getpass import getpass` in there, replace your password with `getpass()`, and you'll be set :)

jerf• 14 years ago

http://www.inutile.ens.fr/estatis/password-security-checker/

(BTW, be sure to type some gibberish into the provided box and hit submit, so you can see why I think this is a very relevant link.)

mcphilip• 14 years ago

The Terms and Conditions are hilarious:

c. You agree to pay $ 100,000 for your use of the Estatis Free Password Security Checker if we ever ask for it.

sp332• 14 years ago

That's a much better link than the one I've been using: http://twitterphishr.com/

raverbashing5• 14 years ago

Bonus points for those who submit, read what it presented then proceeded to test another password!

therandomguy2• 14 years ago

They got me a second time with "Test another password?"

ars• 14 years ago

They have a bug. Type a " character and it gets encoded with a backslash in the output.

rottencupcakes• 14 years ago

I assumed this website was a joke. I'm surprised it isn't.

ChuckMcM• 14 years ago

I saw a spam once that said "Is your husband's password compromised? Check it on this site ..." clearly trying to social engineer a spouse into 'doing a favor.'

These people can be very very very evil.

ajslater• 14 years ago

http://ismycreditcardstolen.com/

yelloblac• 14 years ago

How about submitting the hashes over https, at the very least somebody could be sniffing the traffic from your site and gathering the hash list for themselves..

mrlase• 14 years ago

"Your password was leaked and cracked. Sorry, friend."

Well that's lovely. Just changed my LinkedIn password so hopefully no one had a chance to take advantage of that. Luckily I very recently switched to a new password scheme so my other accounts should be secure too.

jes5199• 14 years ago

yipes - apparently that site sends up an unsalted sha1 of your password. If leaked unsalted sha1s are worth being worried about, then typing your password into this site is just as bad as the original leak

Splines3• 14 years ago

Like others have stated, you should assume your password hash was leaked anyway. Change it first, then put in the old password into this tool for curiosity's sake.

Splines3• 14 years ago

My autogenerated password was in the list, and not cracked.

I've changed it anyway on linkedin.

Aleran• 14 years ago

Same for me. "Your password was leaked, but it has not (yet) been cracked. Fingers crossed."

Damnit, LinkedIn.

ig1• 14 years ago

The site should tell people to change their password anyway regardless of whether it's in the list or not.

Splines3• 14 years ago

We need a "wasmylinkedinpasswordleaked.com" with <h1>yes</h1> as the content.

bevan2• 14 years ago

haha, quite funny. I made it.

isnotchicago• 14 years ago

I don't think a Like button was in the original charter.

hung• 14 years ago

I quickly wrote a script to do this locally, not the most efficient, but I'm at work ;)

https://github.com/hungtruong/LinkedIn-Password-Checker

yalogin• 14 years ago

That works pretty well. And yes, my password is in there.

obituary_latte3• 14 years ago

Thank you. Worked for me as well...

I wonder what kind of bonkers executive at LI decided it would not be a good idea to do a sweeping wipe of all passwords on their systems...

    for user in users:
      force_pw_reset(user);

    def force_pw_reset(user):
      user.pw = rand;
      user.sendResetEmail();

(note to LI: this isn't real code; don't use)

deno3• 14 years ago

Now just send phising emails with fake reset links to your targets at the same time. Password reset should be enforced at first login.

nickzoic• 14 years ago

The problem isn't really your LinkedIn password ... I mean, someone could mess up your profile, send embarrassing messages and so on, but many many people will have used the same password for amazon, apple, paypal and other financial things, or used the same password for an email account which can be used to "recover" the password for one of those things.

spal4• 14 years ago

  $ cat combo_not.txt | grep `printf linkedintrouble | sha1sum`
  3ac85868a20c977661a12f770f0d116f87c74831
  $ cat combo_not.txt | grep `printf nathanlinkedin | sha1sum`
  a4d28368130ad555c77ec6a4dd18b8977ac0f589
  $ cat combo_not.txt | grep `printf mypassword | sha1sum`
  $ cat combo_not.txt | grep `printf yourpassword | sha1sum`
  $

uselessuseof2• 14 years ago

printf linkedintrouble |openssl sha1|grep -f - combo_not.txt

rpicard• 14 years ago

I wrote one in Perl as well. I wasn't going to bother uploading it, but I might as well.

https://github.com/rpicard/misc-perl/tree/master/linkedin-pa...

anon01• 14 years ago

I think its interesting to see what kind of passwords were in there. "password" was of course in there, "password1" was not, "password2" was....

ryeguy_24• 14 years ago

Genius. LinkedIn needs more of you apparently.

imcotton• 14 years ago

There is a tracking service on the results page keep sending out everything you've just submited.

KenCochrane• 14 years ago

You could use the service to see if your new password was already hacked..

ajacksified• 14 years ago

Beat me to my more tounge-in-cheek http://ismylinkedinpasswordleaked.com ;)

will_work4tears• 14 years ago

Somebody had the password test123. Lol. I'm going to go see what other crazy simple passwords people have used.

weakwire• 14 years ago

"binladen" was actualy used for a password at linkedin lol!

wouterinho2• 14 years ago

I'm wondering about the legality of this. If you take an (assumed) stolen dump of sensitive data and turn it into a webservice, could you get in trouble?

tazzy531• 14 years ago

Reminds me of the Seinfeld/MovieFone episode...

"Why don't you just tell me your password..."

eddieplan92• 14 years ago

I made something almost the same (including name!), except all check is done in browser:

http://crackedin.s3-website-us-east-1.amazonaws.com/

And it's hosted on S3 so it is faster :)

raverbashing5• 14 years ago

I just wanted the list in an easily downloadable format so I can check offline

(easily downloadable == not the rapidshare of russia, something you could wget)

But I submitted the hash of my password and it's there so...

Hethrir3• 14 years ago

I have a torrent up of the database so you can check locally,

here: http://www.seedpeer.me/download/linkedin_hashes/ad1e93a1aee2...

joshx• 14 years ago

www.mediafire.com/?n307hutksjstow3

Click download, copy the URL from your browser into wget/axel/download manager. I get a solid 1mb/s from media fire.

wouterinho2• 14 years ago

Interesting implementation, but won't this eat up a lot of bandwidth and cause a high S3 bill?

eddieplan92• 14 years ago

I cut the hash database into 256 pieces based on the last two digits of hash so chunk is smaller than 1MB. To check one password it only downloads one piece. So hopefully it won't be that bad.

dhardy2• 14 years ago

Probably a noob question but... How does this account for any salt that may have been used?

nfm• 14 years ago

It doesn't, LinkedIn didn't salt the passwords.

angusgr• 14 years ago

LinkedIn didn't use a salt. Hence the easier-than-it-should-have-been password crackfest.

(However, could everyone please stop making random websites encouraging people to type in their passwords from third party sites!)

olemartinorg3• 14 years ago

Oh.. Didn't know anyone already made this - i also made a tool, but it doesn't send your whole hash over the wire (only the last 4 chars). http://olemartin.org/linkedin-passwords/

Terretta• 14 years ago

Nice looking page for such fast work. What about letting 'advanced' users check the SHA1 of their password, so they don't enter their password at all but also don't have to track down the giant file?

olemartinorg3• 14 years ago

That should work already - just use the other field and click the button. :-) There's no giant file though, i've split the giant file into ~65000 smaller ones that are more bandwidth friendly.

towts• 14 years ago

i observed it seems this tool and the leaked in one don't agree on the resulting hash value from the same word.

for example this tool says the word "test" hashes with the last 5 digits of 77136 where as leaked in translates the word "test" to fbbd3. hmmm

olemartinorg3• 14 years ago

Thanks! I've changed it now. Seems i didn't catch the key event properly. :-)

alexlitov• 14 years ago

Your password was leaked, but it has not (yet) been cracked. Fingers crossed.

STRiDEX• 14 years ago

Someone used "georgebush"

its_so_on2• 14 years ago

Sorry, I don't mean to be harsh, but this concept is pretty much dead on arrival.

"Check if your hash is still private and secure by sending us your hash."

Well, even if the hash was secure, it isn't now!

(Unless you:

O get the whole database into the client

O ask the user to:

o reload the URL in PRIVATE browsing mode

o DISCONNECT from the network

o test the results with javascript

o close the whole browser

o reopen the browser

o finally, clear flash cookies (how do I even do that?)

o Only then reconnect to the network

All to prevent you from either reading the results afterward or, as regards instructions to disconnect from the network, somehow changing or making a mistake in the javascript, perhaps after we or others have verified and ok'd it.)

If the only answer to the objection against giving you the hash is that you don't ask for the username, you might as well ask for the password plaintext.

Sorry, the concept is pretty much dead on arrival.

Still, way to ship. (or 'nice shipping.' Should be our secret handshake :). Good luck on the next concept.

jperras4• 14 years ago

You should consider the password and hash that you test as already compromised and in the wild, thus making this app just a simple convenience for you and other linkedin users.

its_so_on2• 14 years ago

But... a convenience to do what?

exit• 14 years ago

how can they tell what was leaked but not cracked?

ckrailo• 14 years ago

The cracked passes have hashes starting with zeros. See the discussion here: http://news.ycombinator.com/item?id=4073309

namank• 14 years ago

Well the fun I'm having with this is checking all the trivial passwords that people still use despite warnings.

No, mine isn't in the list.

dsl• 14 years ago

www.wasmylinkedinpasswordstolen.com is much better.

siavosh• 14 years ago

I wish I could down vote or delete this article. Regardless of the creator's intentions, there are a lot of non-techie people on HN (like one of my co-workers) who used this site to check their linkedin password. It reinforces fatal security habits.

fozzle• 14 years ago

I'm really enjoying testing completely silly passwords against the leaks.

'pooppants' is a confirmed hit. "World's Largest Professional Network". I like to imagine some suit with a cigar logging into look for new hires with that one.

dfrey• 14 years ago

My password was leaked and cracked. It is also the same password I use on Hacker News. :((((

Hethrir3• 14 years ago

I think the much bigger risk here is password re-use, think if some CEO used the same password for their website/email?

Also, torrent: http://www.seedpeer.me/download/linkedin_hashes/ad1e93a1aee2...

david_shaw• 14 years ago

Even if this is a completely trusted and secure site, why would you not use SSL for something like this?

Transport layer security is a serious issue, especially for people prone to password reuse.

mark-r• 14 years ago

The link appears to be down now, either it served its nefarious purpose or it's a victim of its own success.

facorreia2• 14 years ago

If your hash is not on that list, it's bad news. There are indications that the hacker published only the hashes he needed help with. The others were more easily decoded.

bevan2• 14 years ago

A better solution:

www.wasmylinkedinpasswordleaked.com

johnchristopher• 14 years ago

If you leave the page opened long enough some random(?) characters fill the input field. What for ?

elchief2• 14 years ago

Good news, the following passwords where not leaked:

  password

  asdfasdf (whew!)

  linkedinpassword

The following were:

  password1

  password$

  linkedin

  a1a1a1a1

  drowssap

  12345678

rajbot• 14 years ago

`password` was leaked. See this comment about the format of hashes in the dump:

http://news.ycombinator.com/item?id=4073928

elchief2• 14 years ago

Hm, when I first typed those in, it said not leaked, but now it is saying leaked for all of them. Apologies.

cristianocd• 14 years ago

please make the wordlist you're getting everyone generate for you available to download!

thanks

x1• 14 years ago

huh, I have a linked in account that I don't check often and my password was on that list. Luckily it was specific to linkedin. I don't believe this is just a small percentage of users. Oh and I never received an email like the blog states (http://blog.linkedin.com/2012/06/06/linkedin-member-password...)... odd...

ronik• 14 years ago

I'm amazed someone took the time to develop this without thinking of the potential trust issues involved.

lifthrasiir• 14 years ago

Heck, isn't it supposed to use type="password" in its input element?

JEVLON• 14 years ago

It is helpful to have a unique password for each meaningful service you use. That way the black-hats can't compromise your other accounts using the same password.

bwei• 14 years ago

Thanks. I was a victim.

therandomguy2• 14 years ago

If any of your had "password" as your password, it has been compromised. I just checked.

andrewpi• 14 years ago

My (previous) password was randomly generated, and it was on this list. Fortunately I had already changed it when I read about the breach earlier on Wednesday.

cpg• 14 years ago

Tangencially related to some of the comments in this thread.

Amahi (my startup) started experiencing lots of spamming accounts a little while ago. We started using blacklists and some heuristics to detect the spammers. Then we logged the attempts.

Some interesting things emerge.

* The vast majority of them have "super123" as the password * The vast majority use emails from china (163.com, qq.com, etc.) * They try twice in a row if the first attempt fails * They try regularly

The suspicion is that they then sell these accounts in bulk for later action. We have seen them have these accounts sitting idle, with occasional logins to check if they still work. Then later they pounce, posting spam links, etc.

The level of sophistication of all this is rather troublesome ...

lucb1e• 14 years ago

Brilliant. Next time I want someone's password I'll create a page similar to this ("check if your password was leaked!") and pretend to spam my entire contact list while my target is really the only person receiving it.

No seriously, how in the world can we trust this website with our password? They don't even claim to keep your password a secret. For all we know this is a follow-up scam to extend the 6.5mil hacked hashes.

Having a very quick glance at the HTML source, it seems they hash it before it's sent to the site to check, but it easily might have been a scam. Or turn into one with a probability of 1 in 10, that still gets them many passwords while remaining to be trusted.

twodayslate• 14 years ago

I was compromised :(

btb• 14 years ago

Ahh interesting. My password was on the list(I changed it before checking).

old password: ve78d9k6k

4c1433ca9d58d7d7ba00658d209583d8edde144a

lollancf37• 14 years ago

lol

jheriko• 14 years ago

this smacks of a scam...

Melug• 14 years ago

If leaked in saves my password, I'm leaked now.

LeakedIn

Related Stories