<story><title>6.5 Million LinkedIn Password Hashes Leaked</title><url>http://translate.google.com/translate?hl=en&amp;sl=no&amp;tl=en&amp;u=http://www.dagensit.no/article2411857.ece</url></story><parent_chain><item><author>dpritchett</author><text>For the security novices amongst us: I had no idea how to do this so I figured out a quick python script to test it:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    &amp;#62;&amp;#62;&amp;#62; from hashlib import sha1
    &amp;#62;&amp;#62;&amp;#62; def check_pass(plaintext, offset=5):
    	hashed = sha1(plaintext).hexdigest()
    	return (hashed, &apos;0&apos; * offset + hashed[offset:])

    &amp;#62;&amp;#62;&amp;#62; check_pass(&quot;linkedin&quot;)
    (&apos;7728240c80b6bfd450849405e8500d6d207783b6&apos;,
     &apos;0000040c80b6bfd450849405e8500d6d207783b6&apos;)
&lt;/code&gt;&lt;/pre&gt;
Edit:  I&apos;m pretty sure JtR refers to this: &lt;a href=&quot;http://en.wikipedia.org/wiki/John_the_Ripper&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/John_the_Ripper&lt;/a&gt;</text></item><item><author>jgrahamc</author><text>Some observations on this file:&lt;p&gt;0. This is a file of SHA1 hashes of short strings (i.e. passwords).&lt;p&gt;1. There are 3,521,180 hashes that begin with 00000.  I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact.&lt;p&gt;Evidence for this is that the SHA1 hash of &apos;password&apos; does not appear in the list, but the same hash with the first five characters set to 0 is.&lt;p&gt;&lt;pre&gt;&lt;code&gt;  5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 is not present
  000001e4c9b93f3f0682250b6cf8331b7ee68fd8 is present
&lt;/code&gt;&lt;/pre&gt;
Same story for &apos;secret&apos;:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4 is not present
  00000a1ba31ecd1ae84f75caaa474f3a663f05f4 is present
&lt;/code&gt;&lt;/pre&gt;
And for &apos;linkedin&apos;:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  7728240c80b6bfd450849405e8500d6d207783b6 is not present
  0000040c80b6bfd450849405e8500d6d207783b6 is present
&lt;/code&gt;&lt;/pre&gt;
2. There are 2,936,840 hashes that do not start with 00000 that can be attacked with JtR.&lt;p&gt;3. The implication of #1 is that if checking for your password and you have a simple password then you need to check for the truncated hash.&lt;p&gt;4. This may well actually be from LinkedIn.  Using the partial hashes (above) I find the hashes for passwords linkedin, LinkedIn, L1nked1n, l1nked1n, L1nk3d1n, l1nk3d1n, linkedinsecret, linkedinpassword, ...&lt;p&gt;5. The file does not contain duplicates. LinkedIn claims a user base of 161m.  This file contains 6.4m unique password hashes.  That&apos;s 25 users per hash.  Given the large amount of password reuse and poor password choices it is not improbable that this is the complete password file.  Evidence against that thesis is that password of one person that I&apos;ve asked is not in the list.</text></item></parent_chain><comment><author>peterwwillis</author><text>Obligatory perl one-liner:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  perl -MDigest::SHA -le &apos;$h = substr( Digest::SHA::sha1_hex($ARGV[0]) , 5 ); open F, &quot;&amp;#60;combo_not.txt&quot;; do { print &quot;found $_&quot; if grep(/$h/, $_) } while (&amp;#60;F&amp;#62;)&apos; password
&lt;/code&gt;&lt;/pre&gt;
(for people without shells)</text></comment>
<story><title>6.5 Million LinkedIn Password Hashes Leaked</title><url>http://translate.google.com/translate?hl=en&amp;sl=no&amp;tl=en&amp;u=http://www.dagensit.no/article2411857.ece</url></story><parent_chain><item><author>dpritchett</author><text>For the security novices amongst us: I had no idea how to do this so I figured out a quick python script to test it:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    &amp;#62;&amp;#62;&amp;#62; from hashlib import sha1
    &amp;#62;&amp;#62;&amp;#62; def check_pass(plaintext, offset=5):
    	hashed = sha1(plaintext).hexdigest()
    	return (hashed, &apos;0&apos; * offset + hashed[offset:])

    &amp;#62;&amp;#62;&amp;#62; check_pass(&quot;linkedin&quot;)
    (&apos;7728240c80b6bfd450849405e8500d6d207783b6&apos;,
     &apos;0000040c80b6bfd450849405e8500d6d207783b6&apos;)
&lt;/code&gt;&lt;/pre&gt;
Edit:  I&apos;m pretty sure JtR refers to this: &lt;a href=&quot;http://en.wikipedia.org/wiki/John_the_Ripper&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/John_the_Ripper&lt;/a&gt;</text></item><item><author>jgrahamc</author><text>Some observations on this file:&lt;p&gt;0. This is a file of SHA1 hashes of short strings (i.e. passwords).&lt;p&gt;1. There are 3,521,180 hashes that begin with 00000.  I believe that these represent hashes that the hackers have already broken and they have marked them with 00000 to indicate that fact.&lt;p&gt;Evidence for this is that the SHA1 hash of &apos;password&apos; does not appear in the list, but the same hash with the first five characters set to 0 is.&lt;p&gt;&lt;pre&gt;&lt;code&gt;  5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 is not present
  000001e4c9b93f3f0682250b6cf8331b7ee68fd8 is present
&lt;/code&gt;&lt;/pre&gt;
Same story for &apos;secret&apos;:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4 is not present
  00000a1ba31ecd1ae84f75caaa474f3a663f05f4 is present
&lt;/code&gt;&lt;/pre&gt;
And for &apos;linkedin&apos;:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  7728240c80b6bfd450849405e8500d6d207783b6 is not present
  0000040c80b6bfd450849405e8500d6d207783b6 is present
&lt;/code&gt;&lt;/pre&gt;
2. There are 2,936,840 hashes that do not start with 00000 that can be attacked with JtR.&lt;p&gt;3. The implication of #1 is that if checking for your password and you have a simple password then you need to check for the truncated hash.&lt;p&gt;4. This may well actually be from LinkedIn.  Using the partial hashes (above) I find the hashes for passwords linkedin, LinkedIn, L1nked1n, l1nked1n, L1nk3d1n, l1nk3d1n, linkedinsecret, linkedinpassword, ...&lt;p&gt;5. The file does not contain duplicates. LinkedIn claims a user base of 161m.  This file contains 6.4m unique password hashes.  That&apos;s 25 users per hash.  Given the large amount of password reuse and poor password choices it is not improbable that this is the complete password file.  Evidence against that thesis is that password of one person that I&apos;ve asked is not in the list.</text></item></parent_chain><comment><author>d503</author><text>If you&apos;re paranoid about shoulder-surfing you can use getpass to hide your password as you type it in.&lt;p&gt;&lt;pre&gt;&lt;code&gt;    &amp;#62;&amp;#62;&amp;#62; import getpass
    &amp;#62;&amp;#62;&amp;#62; password = getpass.getpass(&apos;Password: &apos;)
&lt;/code&gt;&lt;/pre&gt;
&lt;a href=&quot;http://docs.python.org/library/getpass.html&quot; rel=&quot;nofollow&quot;&gt;http://docs.python.org/library/getpass.html&lt;/a&gt;</text></comment>