How Unsalted Password Hashes Enabled LinkedIn Password Cracking

Summary

Using LinkedIn’s 2012 breach as an example, the article explains how dictionary attacks exploit fast, unsalted hashes and why unique salts and slower password-hashing algorithms such as bcrypt make cracking harder.

Key points

• The article says attackers ran wordlists against 117 million SHA-1 hashes exposed in LinkedIn’s 2012 breach, cracking most within days.
• Dictionary attacks compare hashes of common passwords against stolen password hashes; predictable choices make matches more likely.
• Without unique salts, identical passwords produce identical hashes, and attackers can reuse precomputed results.
• Unique salts make each hash require a separate attack, increasing the work needed to crack a stolen database.
• MD5 and SHA-1 are designed for speed, which makes them unsuitable for password storage.
• bcrypt uses a configurable work factor to slow password hashing; the article also names Argon2 as a newer standard.
• The promised hands-on lab is behind a subscription; the article provides an overview of the attack and defenses.

MITRE ATT&CK