image source: Bloomberg

BY EVAN THOMAS

ANCHOR NATHAN BYRNE

The problems aren’t over for LinkedIn. On the heels of privacy concerns with its iOS application, the social network has suffered a security breach and lost some 6.5 million user passwords.

LinkedIn’s blog says “some” of the leaked passwords correspond to user accounts. LinkedIn says it will freeze those accounts until it can notify affected users and get them to change their passwords.

The Register reports whoever stole the passwords might have a comparatively easy time of decoding them — LinkedIn’s database was missing a layer of security.

“Although the website’s engineers hashed the stored passwords - a process that converts each one into a new long string of characters … they did not apply any salt. Salting adds extra arbitrary data to a password when it is hashed, thwarting pre-generated tables and making life difficult for password crackers.”

Sophos took a look at the database of leaked passwords .

“Other passwords that we found in the dump include ‘linkedin’, ‘linkedinpassword’, ‘p455w0rd’ and ‘redsox’. We even found passwords that suggest people should know better like ‘sophos’, ‘mcafee’, ‘symantec’, ‘kaspersky’, ‘microsoft’ and ‘f-secure’.”

Security firm Imperva suggests the actual number of lost passwords could be higher than 6.5 million . Easy passwords like “123456” reportedly aren’t present in the database.

This suggests the easy ones are already known to the attacker or attackers and were thus left off the list. Additionally, each password on the list appears only once, and Imperva suspects duplicates are very likely.

In any case, the U.S. Congress is now getting involved. The Hill says two lawmakers have announced new legislation that would help enforce data security .

“Sen. Patrick Leahy (D-Vt.) and Rep. Mary Bono Mack (R-Calif.) …have sponsored separate bills on the issue. Both bills would create a national requirement for firms to notify their customers in the event of a data breach.”

LinkedIn says it’s now salting its password database to provide some additional protection. Still, now is as good a time as any to change your password.