Tweet
In response to widespread reports of a massive data breach at LinkedIn, the company Wednesday confirmed that passwords belonging to "some" of its members have been compromised.
In a carefully worded blog post, LinkedIn director Vicente Silveira said the company has confirmed that an unspecified number of hashed passwords posted publicly on a Russian hacker forum earlier this week, "correspond to LinkedIn accounts."
Silveira made no mention of how the passwords may have ended up on the forums but noted that LinkedIn is continuing to investigate.
"Members that have accounts associated with the compromised passwords will notice that their LinkedIn account password is no longer valid," Silveria said...........................
.................The breached list shows that LinkedIn did not use best practices in protecting the passwords, he said. The hashes that were used to mask the real passwords were so-called unsalted SHA-1 hashes. SHA-1 is a hashing algorithm that is used to protect passwords. Because SHA-1 isn't foolproof, security experts have for some time recommended that organizations use a technique called "salting" to make passwords harder to crack. With salting, an application applies a random string of characters to a password before it is hashed. The process ensures that even if two passwords are identical, their hashes will be unique.
In a carefully worded blog post, LinkedIn director Vicente Silveira said the company has confirmed that an unspecified number of hashed passwords posted publicly on a Russian hacker forum earlier this week, "correspond to LinkedIn accounts."
Silveira made no mention of how the passwords may have ended up on the forums but noted that LinkedIn is continuing to investigate.
"Members that have accounts associated with the compromised passwords will notice that their LinkedIn account password is no longer valid," Silveria said...........................
.................The breached list shows that LinkedIn did not use best practices in protecting the passwords, he said. The hashes that were used to mask the real passwords were so-called unsalted SHA-1 hashes. SHA-1 is a hashing algorithm that is used to protect passwords. Because SHA-1 isn't foolproof, security experts have for some time recommended that organizations use a technique called "salting" to make passwords harder to crack. With salting, an application applies a random string of characters to a password before it is hashed. The process ensures that even if two passwords are identical, their hashes will be unique.
Comment