Hacker News Reader

Comment by jqueryin | Hacker News Reader

Just a thought, but GitHub could be handling this proactively to ensure the security of their members given the sensitivity of private repositories:

    Step 1: Grab LinkedIn breach data
    Step 2: Compare email addresses/usernames from LinkedIn to GitHub
    Step 3: Check if passwords are the same
    Step 4: Reset password and notify if they match

View on HN

Step 3 is not possible without one of the following;

  GitHub keeps a copy of the password in plain-text
  GitHub keeps a copy of the SHA1 hash of the password
  GitHub cracks the SHA1 hash and checks against their hash
  GitHub calculates the SHA1 hash of the password after a valid login

The 4th option is the only sane approach, but it means you can't 'Check if passwords are the same' in bulk, only as users login.

The LinkedIn dump is trivial to convert back into plain text. They're all SHA1 hashes and aren't salted. You can just download an SHA1 rainbow table[0] and instantly convert them to plain text.

[0] http://project-rainbowcrack.com/table.htm

Correct me if I'm wrong, but rainbow table is for popular password and character combinations yes? If my password is s0m3th1nggsup33rhard, you cant make out the string from the rainbow table.

You're wrong. It's not just a dictionary. While tables are generated with a cap on length and characters used that's not the same as being for popular passwords.

Depends on the specific rainbow table.

The ones I linked to are brute force, every single SHA1 hash for all common ascii characters up to 8 digits long. You can also download smaller rainbow tables for common passwords, dictionaries, or similar.

Ultimately SHA1 is extremely fast to commute in 2016. So even if a rainbow table doesn't suit your needs, you can easily generate a new one which does, but likely you'll break a good chunk of passwords just using the "out of the box" 1-9 A-Za-z0-9 and specials rainbow tables.

Reply on news.ycombinator.com