Step 3 is not possible without one of the following;
GitHub keeps a copy of the password in plain-text
GitHub keeps a copy of the SHA1 hash of the password
GitHub cracks the SHA1 hash and checks against their hash
GitHub calculates the SHA1 hash of the password after a valid login
The 4th option is the only sane approach, but it means you can't 'Check if passwords are the same' in bulk, only as users login.
The LinkedIn dump is trivial to convert back into plain text. They're all SHA1 hashes and aren't salted. You can just download an SHA1 rainbow table[0] and instantly convert them to plain text.
Correct me if I'm wrong, but rainbow table is for popular password and character combinations yes? If my password is s0m3th1nggsup33rhard, you cant make out the string from the rainbow table.
The ones I linked to are brute force, every single SHA1 hash for all common ascii characters up to 8 digits long. You can also download smaller rainbow tables for common passwords, dictionaries, or similar.
Ultimately SHA1 is extremely fast to commute in 2016. So even if a rainbow table doesn't suit your needs, you can easily generate a new one which does, but likely you'll break a good chunk of passwords just using the "out of the box" 1-9 A-Za-z0-9 and specials rainbow tables.
You're wrong. It's not just a dictionary. While tables are generated with a cap on length and characters used that's not the same as being for popular passwords.
