Sha-1 with the hashes salted.

Edit: "Motherboard conversed with someone at LeakedSource who claimed that they managed to crack 90 percent of the LinkedIn passwords within three days. Though LinkedIn says it has hashed and salted its stored passwords for several years now"

http://venturebeat.com/2016/05/18/linkedin-resets-passwords-...

From that 2012 article:

"What's also troubling security researchers is that the password database contains entirely unique passwords. It's unclear whether the people who leaked the password file have more passwords that have not surfaced online. The file may, for example, be an attempt to crowd source the hacking of some of the more difficult passwords."

Well Per Thorsheim called that one!

LinkedIn has a solid security team today. That was probably not the case when this breach apparently happened, though. Just because the dump leaked today has SHA-1 hashes, doesn't mean that's what they're doing now.

If you look at Cory Scott's linked-in profile, you can see that there was NO security team before he was hired. None. The breach happened before he arrived, and he is now having to deal with a four year old breach. He has built a substantial team from nothing and from what I can tell is doing all the right things.

This is just unforgivable. This is such an incredibly basic and simple to implement feature and they've just ignored it. There should be some legal repercussions for companies neglecting security. When they surpass 100,000 users, a mandatory security audit should be passed (like a health and safety inspection). Data breaches like these just happen far too often.