by ·2 Comments

LinkedIn announced on June 6 that it experienced a data breach compromising the passwords of some of its members.   Ten days later, LinkedIn got hit with a class action lawsuit.  The lawsuit was filed in a California federal district court.  You can read the complaint here.

A few key points about the lawsuit:

  • The plaintiffs consist of two classes — (1) anyone in the U.S. who had a LinkedIn account on or before June 6, 2012, and (2) anyone in class #1 who paid for a premium account.
  • The lawsuit alleges that LinkedIn did not comply with industry standard encryption protocols, contrary to its Privacy Policy.  Specifically, the plaintiffs contend that LinkedIn stored member passwords in “unsalted SHA1 hashed format.”
    • In simple terms, adding “salt” to a password means assigning random values to a password to make it more difficult to decipher.  For example, if the password were “JohnDoe,” you could salt it by adding the characters “5a6b7c,” giving you “JohnDoe5a6b7c.”
    • Hashing refers to the process of running a password into a cryptographic function to convert it into an unreadable and encrypted format.  The plaintiffs say that LinkedIn used an outdated hashing function that was first published by the NSA in 1995.
    • The plaintiffs say that LinkedIn should have at least salted the passwords before running them through the hash function.  Better yet, LinkedIn should have salted the passwords, input them into the hash function, salt the resulting hash value, and then run the hash value through a hash function.   Then, LinkedIn should have stored the fully encrypted password on a separate and secure server apart from all other user information.
  • The lawsuit brings claims based on California’s unfair competition law, California’s Consumers Legal Remedies Act, breach of contract, breach of implied covenant of good faith and fair dealing, breach of implied contract, and negligence.
  • The plaintiffs in the first class (all LinkedIn users) say they were in the form of loss of value in their personal information.  (Whether the court will accept that damage theory is questionable.)  Those in the second class (premium members who paid fees) say they were injured in the form of the fees they paid to LinkedIn for premium membership.