It’s not a good day for LinkedIn. After reports that its iOS app potentially violates user privacy by sending detailed calendar entries to its servers, comes a report that 6.46 million encrypted LinkedIn passwords have leaked online.
A Russian forum user claims he has hacked LinkedIn, uploading 6,458,020 encrypted passwords (without usernames) as proof.
The passwords are encrypted with the SHA-1 cryptographic hash function, used in SSL and TLS and generally considered to be relatively secure, but not foolproof. Unfortunately, it also seems that passwords are stored as unsalted hashes, which it makes it much easier to decipher...
