News for hackers. Stuff that matters.
Re:LeakedIn by eddieplan9 on Wednesday June 06, 2012 @03:42PM (#4075767)
I made something almost the same (including name!), except all check is done in browser:

http://crackedin.s3-website-us-east-1.amazonaws.com/

And it's hosted on S3 so it is faster :)

Re:LeakedIn by raverbashing on Wednesday June 06, 2012 @03:48PM (#4075800)
I just wanted the list in an easily downloadable format so I can check offline

(easily downloadable == not the rapidshare of russia, something you could wget)

But I submitted the hash of my password and it's there so...

Re:LeakedIn by Hethrir on Wednesday June 06, 2012 @04:45PM (#4076132)
I have a torrent up of the database so you can check locally,

here: http://www.seedpeer.me/download/linkedin_hashes/ad1e93a1aee2...

Re:LeakedIn by joshx on Wednesday June 06, 2012 @05:37PM (#4076361)
www.mediafire.com/?n307hutksjstow3

Click download, copy the URL from your browser into wget/axel/download manager. I get a solid 1mb/s from media fire.

Re:LeakedIn by wouterinho on Wednesday June 06, 2012 @03:50PM (#4075817)
Interesting implementation, but won't this eat up a lot of bandwidth and cause a high S3 bill?
Re:LeakedIn by eddieplan9 on Wednesday June 06, 2012 @03:53PM (#4075834)
I cut the hash database into 256 pieces based on the last two digits of hash so chunk is smaller than 1MB. To check one password it only downloads one piece. So hopefully it won't be that bad.
Re:LeakedIn by biot on Wednesday June 06, 2012 @04:53PM (#4076161)
Assuming the split is computer-generated based on a parameter, why not use the last three digits and cut it into 4096 pieces, where each chunk is under 64KB? If your bandwidth bill is small it won't matter (ie: not worth the time involved) but if you get a bunch of traffic your cost is 1/16th of what it would have been. Also, to the user the site will be way more responsive as the download will happen quicker.
Re:LeakedIn by rheide on Wednesday June 06, 2012 @09:38PM (#4077146)
Bloom filter?
Re:LeakedIn by dhardy on Wednesday June 06, 2012 @11:31PM (#4077465)
Probably a noob question but... How does this account for any salt that may have been used?
Re:LeakedIn by angusgr on Thursday June 07, 2012 @12:01AM (#4077543)
LinkedIn didn't use a salt. Hence the easier-than-it-should-have-been password crackfest.

(However, could everyone please stop making random websites encouraging people to type in their passwords from third party sites!)

Re:LeakedIn by dhardy on Thursday June 07, 2012 @11:55AM (#4079608)
I suspected that was the answer but this blog post http://blog.linkedin.com/2012/06/06/linkedin-member-password... mentions that they are salting the passwords.
Re:LeakedIn by nfm on Wednesday June 06, 2012 @11:42PM (#4077496)
It doesn't, LinkedIn didn't salt the passwords.