LinkedIn admits site hack, adds pinch of salt to passwords

LinkedIn has confirmed that the list of 6.5 million user passwords leaked yesterday is genuine.

The social network for suits said it was still investigating the situation, but it said the SHA-1-hashed password list posted on a Russian Dropbox-alike site contained real user data. LinkedIn has chucked compromised users' passwords out and will be sending them emails to let them know how to get a new one (full details of the process here).

Although the website's engineers hashed the stored passwords - a process that converts each one into a new long string of characters that are tough or impossible to convert back into the original password - they did not apply any salt.

By overlooking this technique, it is easy for hackers to produce a so-called rainbow table of hashes from possible passwords and search for these in the leaked list, thus identifying a significant number of the original passwords. Salting adds extra arbitrary data to a password when it is hashed, thwarting pre-generated tables and making life difficult for password crackers.

The firm said that its security has been tightened.

"It is worth noting that the affected members who update their passwords and members whose passwords have not been compromised benefit from the enhanced security we just recently put in place, which includes hashing and salting of our current password databases," the network said in a blog posting.

The company also apologised to its users for the breach.

Dating site eHarmony was also hacked, possibly by the same attackers that hit LinkedIn. The site said it was resetting the passwords of affected users and assured members that it used "robust security measures, including password hashing and data encryption". ®