Password Security and Hash Slippage

DZone's Guide to

Password Security and Hash Slippage

Gunnar Hillert

Jun. 12, 12 · Java Zone

Free Resource

Like (0)

Comment (1)

Save

{{ articles[0].views | formatCount}} Views

Download Microservices for Java Developers: A hands-on introduction to frameworks and containers. Brought to you in partnership with Red Hat.

The massive losses of password hashes at LinkedIn [1], eHarmony [2] and Last.fm [3] are very concerning, to say the least. These are companies that are generally perceived as technology leaders, particularly LinkedIn. Also, as far as I now, eHarmony and LinkedIn are Java/JVM shops. Just some data that I gathered today regarding the scope of the issue:

Last.fm - presumably up to 17 million lost hashes - Algorithm used: MD5 - Hashes were Not salted
eHarmony - 1.5 million hashes - MD5 - No salted - All upper-case-passwords
LinkedIn - 6.5 million hashes - SHA1 - Not salted

Some of the leaks supposedly happened as far back as 2011. Here is some further background information:

What is quite amazing to me, is that the basic measures that would prevent the cracking of the hashes, like better hash algorithms, salting, re-hashing are not rocket science. There is even a very nice library [4] out there that does it for you and it even hooks into e.g. Spring Security [5] - Not even Java coding is necessary.

I just wonder how the hackers got access to the hashes in the first place...I could not find any information on that, yet. Maybe another juicy story...

[1] http://blog.linkedin.com/2012/06/09/an-update-on-taking-steps-to-protect-our-members/
[2] http://advice.eharmony.com/blog/2012/06/07/updates-on-ongoing-efforts-to-protect-our-members/
[3] http://blog.last.fm/2012/06/08/an-update-on-lastfm-password-security

[4] http://www.jasypt.org/

[5] http://www.springsource.org/spring-security

Download Building Reactive Microservices in Java: Asynchronous and Event-Based Application Design. Brought to you in partnership with Red Hat.

DOWNLOAD

Topics:

Like (0)

Comment (1)

Save

{{ articles[0].views | formatCount}} Views

Published at DZone with permission of Gunnar Hillert. See the original article here.

Opinions expressed by DZone contributors are their own.

Password Security and Hash Slippage

Password Security and Hash Slippage

Java Partner Resources

Java Partner Resources

THE DZONE NEWSLETTER

Dev Resources & Solutions Straight to Your Inbox

Thanks for subscribing!

Awesome! Check your inbox to verify your email so you can start receiving the latest in tech news and resources.

{{ editionName }}

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.linkDescription }}

Password Security and Hash Slippage

Password Security and Hash Slippage

Like This Article? Read More From DZone

Java Partner Resources

Java Partner Resources

THE DZONE NEWSLETTER

Dev Resources & Solutions Straight to Your Inbox

Thanks for subscribing!

Awesome! Check your inbox to verify your email so you can start receiving the latest in tech news and resources.

{{ editionName }}

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.linkDescription }}