LinkedIn Leak: Change your passwords

This is an area where the internet as a whole has to get better.

Changed it now

Thanks for the headsup Paul!

By the looks of it this could be a rumour .. but always best to be safe than sorry.

Would be good to know if they got usernames/emails for sure, hopefully Linkedin will give us more on it asap.

More importantly: Do you use the same email and password for your PayPal account? If so, better change PayPal password before anything else!

*bumping* : This is important people.
While you may not necessarily be affected, if you are on "the list", and you happen to use same pass across multiple accounts, simply changing your pass on LinkedIn might not be enough. (and definitely recommended to change on multiple sites if that is the case).

Here's some technical details:
The password list is 'hashed', meaning it is not plain text of your password.

SHA-1 : regarded as 1 of the more secure hashing algorithms, but is not foolproof.
The security folks here might also recognize this vulnerability : They do not use a "salted" hash, which means "cracking" an individual password (or, more correctly a list of viable SHA-1 equivalent hashes of the password) can be expedited through the use of a 'rainbow table'.

Take some time, think about where else you use these same password, and change it in those systems as well. Don't "panic", but please do take action.

Short tip: a "complex" password on most sites is defined as what? 8 characters, upper, lower, and a character/number combo... LENGTH, however, is better than complexity (and takes longer to crack). And can be EASIER to remember! complexRandom is semi-secure, but sort of easy to brute-force or hash-attack.

Example (complexRandom): uC@!*d#! (8 characters; mid-level easy to brute-force, but impossible to remember...)
Example (Long): MyPuppysNameIsFido!HeIsCute!warDotCom

^^^ What is that? (an easy to remember password (not mine, btw ))
the base length is nearly 30 characters, has complexity AND, a randomness that only I know about (first 3 letters of site, then DotCom or DotOrg or whatever). This means that I can use the same "base" password, and STILL have a different password at EVERY site.

This is important to avoid the vulnerabilities introduced by password leaks like this. And, unlike complexRandom, I can actually REMEMBER it for EVERY site I go to. And because of the length, it is virtually unbreakable for sites that allow long-ish passwords.


Rainbow Tables: Rainbow table - Wikipedia, the free encyclopedia
More News on leak: 6.5 million LinkedIn passwords leaked: report - Technolog on msnbc.com
Password Length vs. Complexity: Password size does matter | Security Central - InfoWorld

Fight on warriors!
-Kevin

Thanks for the heads up. I've just changed my password (s) !

Just came here minutes ago from Linkedin and no mention of it on their site -- but changed pw anyway. Certainly never hurts.

I read that earlier today. It was a horrible security breach for LinkedIn!

Confirmation directly from LinkedIn:

http://blog.linkedin.com/2012/06/06/...s-compromised/

Just found this leakedin.org <-- you can check to see if your password was leaked

Sigh. A related scam...

That Was Fast: Criminals Exploit LinkedIn Breach For Phishing Attacks - NYTimes.com

Well done Paul, we posted this earlier, so thought the tip in it would help, as unless you use an on the fly encoder on EACH login, passwords will always be at risk on line...

http://www.warriorforum.com/main-int...words-now.html

For those that are serious about your passwords and secure login's, a lot of our clients with NDA / Gov approved login requirements use this:

Lastpass.com

Time for a sticky as 6.5 million (plus the amount not reported yet!) hacked passwords will take a long time to get round the interweb for everyone on Linkedin to change!

If eveyone adds a Linkedin status update now, this will get round a lot quicker

Thanks Paul,

I actually did this yesterday. I heard about it on the radio. The way I use passwords is I have 3 different random passwords that I have memorized. Each one is 7 or 8 characters long. Then I put 2 of them together in different combinations for different sites. That makes 14-16 characters passwords randomized. For some sites that should have a little extra security I throw in two upper case letters and two non alphanumeric characters on the end.

That has held up on all my sites so far. And I also exchange one of the random passwords every 3-12 months or so.

Just a tip...

~Olav