Re:LeakedIn
by pbreit on Wednesday June 06, 2012 @02:58PM
(#4075511)
Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
[ Parent
| on HN ]
http://www.inutile.ens.fr/estatis/password-security-checker/
(BTW, be sure to type some gibberish into the provided box and hit submit, so you can see why I think this is a very relevant link.)
The Terms and Conditions are hilarious:
c. You agree to pay $ 100,000 for your use of the Estatis Free Password Security Checker if we ever ask for it.
"All States shall be entitled to lay submarine cables and pipelines on the bed of the high seas."
oh dear.
Re:LeakedIn
by anonymoushn on Wednesday June 06, 2012 @11:33PM
(#4077470)
That's the Geneva convention. It's right after a chapter of Frankenstein.
Is that a Masonic Chapter? Did that happen before or after they started the alamo?
Re:LeakedIn
by raverbashing on Wednesday June 06, 2012 @04:41PM
(#4076106)
Bonus points for those who submit, read what it presented then proceeded to test another password!
Re:LeakedIn
by therandomguy on Thursday June 07, 2012 @01:04AM
(#4077690)
They got me a second time with "Test another password?"
That's a much better link than the one I've been using: http://twitterphishr.com/
They have a bug. Type a " character and it gets encoded with a backslash in the output.
This is fixed. Thanks :-).
Re:LeakedIn
by joshuahedlund on Wednesday June 06, 2012 @03:10PM
(#4075573)
Even if you don't check the source code to verify that it's harmless, you should assume your password has been compromised and have already changed it anyway. This just lowers the cost of checking the list and could help us learn more about the compromise.
If the hole that let them in hasn't been closed yet, changing the password will make that password vulnerable, right?
LinkedIn said:
> users who have already changed their passwords or created a new account won’t have to worry, as they have recently begun hashing and salting their current password databases.
http://techcrunch.com/2012/06/06/linkedin-speaks-some-of-tho...
"recently"?!?
Yes, it could have been a little earlier but from what it seems, it was before the leak.
Re:LeakedIn
by raverbashing on Wednesday June 06, 2012 @03:50PM
(#4075823)
In other news I have a startup on credit card security
Just submit your credit card number, CVV2 and expiration date and it'll check if it has been stolen over the internet for you
Hate to say it, but someone executed on this before you: http://ismycreditcardstolen.com/
Re:LeakedIn
by raverbashing on Wednesday June 06, 2012 @05:05PM
(#4076221)
I'm not worried, mine is "Social"
Cool, does it use Web 2.0 and have an API?
"Kara's credit card has been stolen :(" 4 likes
Will you be directing the form submission page to a static HTML page reading "Yes"?
Oh, I think I know you. You're that Nigerian prince I keep getting emails from, right?
You can supply just your password hash if you want, and if you supply the raw password, it's hashed client-side via Javascript before being sent to the server. Test it out with firebug and a dummy password if you're not keen on wading through the source.
Still, hashes can be cracked, and an evil password-checking website can then associate the password with all of the other personally-identifiable data that browsers are known to leak. I don't think this particular site is being evil, but it would be wrong for a user to trust a site like this.
Again, you can check the source. It's a single page for a reason ;-). There's no trickery hidden in there.
Maybe no trickery hidden in there now, but that could change any time.
Or sometimes. Or depending on IP, browser or OS.
And even if there's no "trickery" from the hosting site, they're slurping in javascript from a 3rd party down the bottom (getclicky). That means they (or anybody who compromises them) could grab the cleartext passwords from the form before the inline javascript does it's sha1 hashing…
I mean server-side (can we check the source for that?). The server could crack the hash, and the server could use various pieces of data (ip address, http headers, etc) to try to figure out more about the password's owner.
True, that's completely possible. However, if this concerns you then you should probably not sign up for any account on any site, since they could be doing the very same thing with your actual password.
Which is why you use different passwords on different sites.
Re:LeakedIn
by raverbashing on Wednesday June 06, 2012 @04:43PM
(#4076121)
What would be good is to have the 'checking request' return a json (or just a short info) and not a whole html
Just change your password before checking. You should've had already, anyway.
I saw a spam once that said "Is your husband's password compromised? Check it on this site ..." clearly trying to social engineer a spouse into 'doing a favor.'
These people can be very very very evil.
If you don't particularly trust the included click.js script, you can generate your password's SHA-1 via python fairly easily
python -c 'import hashlib; print hashlib.sha1("PaSSw0rd").hexdigest()'or easier and shorter:
printf PaSSw0rd | sha1sumOr call shasum or sha1sum and input your password on stdin so your shell history doesn't contain your password in plain text.
Just pop a space at the beginning and it won't go into shell history.
It does for me
> echo test
test
> history
...
6730 echo test
6731 historySet this in your .bashrc
HISTCONTROL=ignorespace
HISTCONTROL=ignoredups:ignorespaceThat's a bash-ism that's controlled by the $HISTCONTROL environment variable, not universally-applicable advice. $HISTCONTROL set to "ignorespace" or "ignoreboth" may or may not be the default, depending on your distribution.
Yeah already replied below specifying that - I was under the impression that it's default to on in most distros, but don't actually have a clue which do/don't.
it will still be in ps output for a short while...
Ultra paranoid. I like the way you think.
python -c 'import hashlib; from getpass import getpass; s = hashlib.sha1(); s.update(getpass()); print s.hexdigest()'how do you get rid of the carriage return as last char that way?
Use Ctrl-d to end input without hitting return and you shouldn't get a newline.
bash, at least, only handles Ctrl-d on its own line.
If you're not on a new line, you can type Ctrl-d twice.
What if my password contains % characters?
Re:LeakedIn
by eric_bullington on Thursday June 07, 2012 @07:20AM
(#4078411)
Yeah, note that this doesn't work with all password combinations. I just use the Python version above
python -c 'import hashlib; print hashlib.sha1("reALpassWORD12%12").hexdigest()'
history -d $((HISTCMD-2))
Add a `from getpass import getpass` in there, replace your password with `getpass()`, and you'll be set :)
Re:LeakedIn
by rottencupcakes on Wednesday June 06, 2012 @04:41PM
(#4076100)
I assumed this website was a joke. I'm surprised it isn't.
correct horse battery staple.
Years ago, 1996, we had a border router that we inherited and didnt have the password to, nor any way to get it. It was in production and we needed to get the password without killing the config.
David Sifry (founder of linuxcare) was my consultant on the issue - he was able to recover the password after some effort. I'll never forget what it was: Feet4monkey
Your post reminded me of that.
My password is 'password1' and it's on that list... Yikes.