Hacker News Reader

Hacker News

Comment by mkjones | Hacker News Reader

Parent Full thread

mkjones

Those just look like hashes - are there usernames / salts somewhere? They do indeed seem to be salted.

View on HN

No they're not. I tried the following:

> irb

> require 'digest/sha1'

> Digest::SHA1.hexdigest 'my_password'

=> hash_string

Then I searched the file with the hash string and found my password. I really hope they don't also have the usernames somewhere.

Interesting, I tried this with a bunch of different passwords (though using php's sha1 function, which obviously gives the same output as ruby's), and found no matches. You're using the "combo_not.txt" file from the zip file in the ggp, right?

The dump is not complete -- my password is also missing. As other people said, that file contains about 6.5 million hashes, while LinkedIn has 30 times more users.

Considering how usernames weren't leaked, there's a big chance that the intruder is just sitting on them and the other passwords.

My password is missing too (if i've done right the hash generation as illustrated above). It's strange that only hashes starting with "000000a9" are present, someone said here that it's just presentation but my hashed password is 40char long as those leaked including the 000000a9

Either you don't have a complete file or you haven't scrolled through it. Only the first 277 hashes start with that string (and some others scattered throughout).

i was talkin about hashes starting with 0000 (i just looked at the beginning and the end of the file). jgrahamc posts is useful, if i dont consider this 0000 (that could be a sign of "ok we've decrypted it" i can find my hash (password was not very difficult)...

Thank you!

How can you tell?

Not finding 'password', 'foobar', '1234' suggests salted passwords.

Very good point. Although some sites have password rules that would prevent those.

The hash list posted might be incomplete.

check jgrahamc post at the top

'password' and 'foobar' are both in there. '1234' is not, but that's probably because of a minimum length requirement.

Edit: '12345678' is in there, further bolstering the length requirement theory.

Correct.

From LinkedIn: "Passwords are case-sensitive and must be at least 6 characters."

Reply on news.ycombinator.com