Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

leakedin.org claims to offer a service checking if your LinkedIn password has been stolen and whether it has been cracked.

The website claims that it's pure Javascript, that is your password won't leave your computer, and says you can provide a SHA-1'd password if you want. But I don't know the people who created leakedin, so I don't know that they're non-malicious, and competent enough to not have their own website hacked to introduce malicious code.

I'd advocate changing your linkedin password (and any other websites that use the same password) first, and only then use linkedin.org, but is it safe to use the website?

share|improve this question
8  
Related: ismycreditcardstolen.com –  Gurzo Jun 7 '12 at 16:20
1  
Also related: Leakedln.org. Made by Stefan Esser. Also well known for PHP security. –  Ladadadada Jun 8 '12 at 6:22
    
This site doesn't check if your password was stolen. Nobody knows how many passwords were stolen. It checks, or so it claims, if yours was one of those leaked. But you should change your password anyway. This gives LinkedIn a chance to salt and re-hash your new password with the enhanced security their blog post claims they are now using. LeakedIn seems completely pointless, at best, to me. –  Craig Stuntz Jun 8 '12 at 15:26
    
how could it be done purely in javascript without using a webservice to look up a database? - what all the 6 million names are in the .js file?! sounds very, very dodgy to me. –  Jeremy Thompson Jun 10 '12 at 6:45
2  
@JeremyThompson the pass->hash calculation was done client side, in Javascript. Then the server checked the submitted hash. –  Krzysztof Kotowicz Jun 19 '12 at 10:53
show 1 more comment

8 Answers

As others have pointed out, there are limits to how secure a service like leakedin.org can be demonstrated to be, and even more potential weaknesses.

Better is to check your password offline yourself. At the moment, you can download a Ruby script or a python script or a shell script that you can inspect and run on your own computer to do the checking, providing you have the leaked hash file combo_not.txt. That file is popping up and disappearing around the net, but should be accessible via bittorrent for long time. As of right now, you can get the file from several places

share|improve this answer
add comment

Common sense dictates that you should not give your password to anyone except for the system the password is intended to be used on. Therefore you should not provide your password in any form to LeakedIn or any other third-party site. You could even be in violation of LinkedIn's TOS for doing so, depending on how it's written.

If common sense isn't good enough reason, let's put on our tin-foil hats and think about what could really be done with the information you give LeakedIn.

First, I'll establish a few presumptions:

  1. The site owners could be malicious, or the website/domain could fall under malicious control/monitoring without us, the end-user, being aware. After all, the connection is clear-text HTTP with no real Identification & Authentication in place to prove that the site content reaching the end-user was created by its purported originators. Regardless of how LeakedIn functions now, we cannot presume that it will continue to operate as (relatively) benignly as it seems.

  2. Whomever hacked LinkedIn probably has more information than has been released. This most likely includes the usernames and/or e-mail addresses that are associated with the password hashes. It very well could include a list of IP addresses known to be used with each username. This information could also be in the hands of whomever is controlling or monitoring LeakedIn.

  3. Most people are just going to fill in their clear-text password and submit the form - Joe User doesn't know or care much about SHA1 hashes and such, he just wants to know if his password has been leaked. The below outcomes are presuming that an actual password is entered.

All of the above can pretty much be summed up in this: When Joe User uses LeakedIn, he should presume that he is providing, at minimum, his IP address, cleartext password, and SHA1 password hash to an unknown and potentially malicious entity.

Given this, and the information that we're presuming the unknown entity (hereafter referred to as the attacker) might already have, what could be done?

  1. If the password has already been cracked, there's effectively no gain to the attacker.
  2. If the password has not already been cracked, you've just helped him crack your password. Not only that, you have also effectively cracked the hash of anyone else who uses the same password (since LinkedIn didn't use salts) for him.
    • At the very least, this helps the attacker to build a dictionary and rainbow table for use in future attacks.
    • At the worst (presuming the attacker has e-mail addresses and usernames, and passwords have not been changed yet) the attacker now has access to your account on LinkedIn and any other site where you use the same password. What's worse, you've also effectively given the attacker the same access for any other user who might unknowingly use the same password you have.

Even in the best scenario, which presumes the attacker only has a list of hashes and the site is benign and only sends SHA1 hashes to the attacker, you're still giving a hash of your password and your IP address to the attacker. The end result is still that the attacker now has more information about you than he did before, which is something that you should generally avoid. This can greatly facilitate future attacks against you and/or your accounts, and could even facilitate attacks against others who use the same password as you.

share|improve this answer
2  
Minor correction - leakedin let's you input a unsalted sha1 hash to check (that you computed yourself using say echo -n "your_password"|openssl sha1), which will not immediately reveal your plaintext password even if the site maliciously records the plaintext password (which for me it does not appear to be doing at the moment). However, even if linkedin hasn't leaked your sha-1 hash (only about ~3.7% of users had leaked hashes), ironically you just gave it away - the very thing you were worried about happening. –  dr jimbob Jun 7 '12 at 17:14
1  
@drjimbob On Windows, ECHO does not have an -n parameter, and openssl is "not recognized as an internal or external command", in Windows. Mind giving some help for the other 90% of the world? –  Iszi Jun 7 '12 at 18:24
    
@drjimbob Also notable, the "3.7% of users" is only those that we know. Firstly, we don't know for sure how many hashes the actual attacker has possession of and secondly we don't know how many un-leaked hashes are actually duplicates of leaked hashes. –  Iszi Jun 7 '12 at 18:26
    
Yes; was erring on the side of caution. It wouldn't be particularly surprising if 150 million users only have 6.5 million unique hashes; though my old linkedin password (randomly generated) was not in either leaked list. I don't think the windows shell can calculate hashes without an external utility. But if you have python installed you should be able to do something like python -c "import hashlib;print hashlib.sha1('your_password').hexdigest()". FYI, The -n argument to echo suppresses the new line at the end of the echo so you calculate the hash of "password" not "password\n". –  dr jimbob Jun 7 '12 at 19:13
add comment

One thing is missing from this discussion:

At least the first 24h of leakedin.org being online they were using an external user tracking service. Because the password hash is submitted through the URL by the HTML form on leakedin.org that external service got a copy of every password hash analyzed by leakedin.org.

This means whatever the service told you about the leak status of your password, by simply entering it you gave the hash away to the logfiles of a user tracking company called GetClicky.

share|improve this answer
    
Do you have any sources confirming this claim? –  Andrew Grimm Jun 8 '12 at 12:40
    
@AndrewGrimm see drjimbob's answer. –  Iszi Jun 8 '12 at 12:47
add comment

Depends on what you mean by safe to use. The service when I tested does not record your plaintext password, but likely is recording your unsalted hash. Note this could easily be changed going forward and could later start recording plaintext passwords, unless you only input a hash on the site. EDIT: Rather than using this site, I recommend https://lastpass.com/linkedin/ (based on this answer ) as it uses https from a known entity and is likely more trustworthy.

If you type your plaintext password into the source field, client-side javascript in your browser converts that password into a unsalted SHA-1 hash, and then that SHA-1 hash gets sent over the network to leakedin.org to see if your hash is in the 6.5 million list. The actual http GET request sent from your browser to their server looks like (after typing 'password' into the field):

GET /?check=5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8 HTTP/1.1
Host: leakedin.org
Connection: keep-alive
User-Agent: [scrubbed]
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://leakedin.org/?check=7ecfd8f97b4729c6ff0799b0b4d40f870083b461
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: first_pv_66595923=1; _jsuid=1189493102
Query String Parametersview URL encoded

The info from plaintext password can't be recorded as the cookie doesn't change significantly with different plaintext passwords, and no AJAX requests/XHR were noted. (There is also a request sent to in.getclicky.com but it seems to be benign web analytics -- like google analytics and does not seem to record your password in plaintext or be encoding it somehow).

However, you should note that once you try this service, even if linkedin didn't leak your unsalted hash, you just leaked your unsalted hash to an unknown entity (and that entity now has tied your password to a specific IP address) -- the very thing you were initially worried about. If you think a dedicated hacker could brute-force your hash in trillions of attempts you have now lost and need to stop using the password you just tested. However, if you already changed your password and are now just curious, you could use this service to check. If you are weary of them recording your plaintext password and not just the hash, you should recommend compute the hash on your own computer (e.g., echo -n "password" | shasum or echo -n "password" | openssl sha1 work in linux/unix or if you have python installed you should be able to do something like python -c "import hashlib;print hashlib.sha1('your_password').hexdigest()).

share|improve this answer
    
The entity that runs the website in question is actually known. Lastpass could be recording your information also. –  Ramhound Jun 7 '12 at 17:40
4  
@Ramhound Sure, but with ordinary http connection anyone could MITM unlike with https. I did a whois on leakedin.org and it was anonymized; though looking at the credits more carefully, the "friends" link goes to http://shiflett.org/ who takes responsibility for it on their blog and can be considered a known entity (e.g., has a whois listing and a longtime web presence); so I deleted my other comment. –  dr jimbob Jun 7 '12 at 17:48
2  
@Ramhound being a "known entity" isn't necessarily a good thing, in this case the entity is more "notorious" than "known". I.e. it is known that they are not "competent enough to not have their own website hacked to introduce malicious code". –  AviD Jun 7 '12 at 19:29
1  
You seem to have an extra hash in the referer. Did you mean to leave that there? –  Ladadadada Jun 8 '12 at 6:14
    
@Ladadadada - good catch. I was trying several different dumb passwords ('aaaaaaaaaaaaaaa', 'open sesame', 'passw0rd', 'qwertyuiop', etc.) to see if any of extra information changed that could somehow be encoding the plaintext password in a recoverable way. I had tried my hash at some point (computed client side), but it wasn't that hash. (That hash happened to be freedom which is not a password I use (for the past several years I only use passphrases and randomly generated strings). –  dr jimbob Jun 8 '12 at 14:32
add comment

I analyzed what is being sent to the server, and only the hash is sent, no other information.

Now, as @drjimbob mentionned, since LinkedIn doesn't add a salt in their password (neither Leakedin.org then), it can be quite easily reverted to your original clear password using a rainbow table.

Finally, even if this is possible, I'm sure you don't have to be paranoid : at worst, Leakedin will get your password+ip, no more. With those two informations, they can't do much.

But keep in mind that if your password has been compromised, it mean that with just the hashed password, they can find the username associated with (since the leak contains username+password). They can try this password with other services like Facebook, and if you use the same username/password, then, all your accounts can be compromised.

Now, Leakedin.org has been made with Chris Shiflett, someone well known in the PHP community. I serously doubt he would do something as bad as storing your tested password.

LastPass also suggest a similar tool, but like Leakedin.org, even if the company behind it is more trusted, you can't be sure they won't store your credentials.

What would be best is :

  1. Putting the entire database in javascript and the whole algorithm in clear in the page. But it would be a hell of a loading!
  2. Put the system that analyze your hash in public source allowing everyone to check whether your password is stored or just compared.
share|improve this answer
3  
Re Shiflett - I think you're understating how well-known he is. It would be more accurate to say that he is "notoriously well known", emphasis on the notorious. I.e. he may not be evil enough to store it, but it is doubtful that he is smart enough not to store it. –  AviD Jun 7 '12 at 19:39
1  
I think your comment says it all! I don't see how I could add this to my answer without just quoting your whole comment! :) –  Cyril N. Jun 8 '12 at 5:40
    
About point #2 at the end: even if someone were to go through that source code in full, what guarantees would they have that it actually corresponds to what is really running on the server? –  Michael Kjörling Jun 8 '12 at 7:48
add comment

As soon as you type something into an input box on a web page, consider it potentially disclosed. Communication can happen asynchronously via JavaScript (aka AJAX) without you ever clicking a submit button. If it is truly pure JavaScript, you should be able to see the hashes in the source for yourself. Yank them out, compute the sha1 locally, and then do the check yourself. Alternatively, hunt down the leak and see what was really disclosed.

If you had a LinkedIn account, change your password regardless. There is no guarantee that the disclosure was full. That is to say, there is no guarantee that LeakedIn or any other single source really has everything that was leaked, yet.

share|improve this answer
    
common! just change your password and then for fun check if yours was hacked, i did test some fake passwords and then the real one and indeed my real old password was hacked while the ones i invented were not. so for sure you should not trust them but yes their test method seems correct. –  smiley Jun 7 '12 at 16:15
    
@smiley That's great as long as you trust the site to actually be what it says it is, and from who it says it's from. Without HTTPS, we can't be certain of either. See my answer for how you using the site, were it to be under malicious control, could actually be hurting others as well as yourself. –  Iszi Jun 7 '12 at 18:20
    
The hashes list is around 250MB uncompressed. It's not in the source code of the web page. –  Ladadadada Jun 8 '12 at 6:19
add comment

As the main principal of security says: be careful about whom you are required to trust. I never ever put my password (in a plain-text) in the place which encourage me to do it.

leakedin.org asks us about our password in plain-text and state if our password had been leaked or not. This means that they could possess the part of leaked database. If leakedin.org's intentions are evil, then they could store typed passwords in their database for the obvious reason: create a dictionary which will help in faster cracking uncracked passwords. Of course I'm not saying that leakedin.org uses described method, but from the security point of view: we should think what our risk is, if they could store typed passwords.

Secondly, I'm not sure why you want to check it. Curiosity killed the cat. You should just change your password on linkedin (and any other websites that use the same one) and forget about your old password.

share|improve this answer
add comment

Well to an extent there's a question of what are you trusting them with? as it's just the password with no associated username, they it would be likely difficult to exploit without further work to get a username/e-mail address to associate the password with.

That said obviously going to any unknown website and interacting with it could present a risk (eg, someone using Beef or similar)...

If you do want to check on the status of your linkedin password, I'd be more inclined to use the checker at lastpass. They've got a reputation in the security field to protect and also their page is using SSL, so less risk of your password being leaked..

share|improve this answer
    
@drjimbob - Except the unknown entity is actually known? –  Ramhound Jun 7 '12 at 17:38
3  
@Ramhound Arguably. The site is not HTTPS, so no given user can ever be absolutely certain they're using the actual site put up by the supposedly known entities. –  Iszi Jun 7 '12 at 18:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.