LinkedIn was criticized for using SHA-1 to hash passwords after the 2012 password hack. The breach exposed nearly 6.5 million password hashes, and security experts criticized the lack of salting and the weakness of the hashing approach.
The attack occurred on June 5, 2012, when passwords from LinkedIn accounts were stolen and published online. Because the passwords had been hashed without a salt, attackers could compare the hashes with precomputed tables and common-password lists, making recovery substantially easier than it would have been with a modern password-hashing design.
SHA-1 is a cryptographic hash function, not an encryption method: hashes are intended to be one-way representations. However, general-purpose hashes such as SHA-1 are too fast for password storage, allowing attackers to test huge numbers of guesses quickly. bcrypt, a deliberately slow password-hashing function, is a different technology and was one of the alternatives commonly contrasted with LinkedIn’s older approach.