2-step authentication?
LinkedIn password leak
91–100 of 218 posts
Re: LinkedIn password leak
#92this might be a dumb question - but if the password was unique to that account AND you have 2 factor auth enabled, is there any reason you need to change the password ? so if some hacker somehow manages to backward engineer a salted-bcrypted-hash of my unique password, he still cant get in without my cell phone
he could attemp to reuse the password in other websites
Re: LinkedIn password leak
#93Earlier quoted context omitted.
So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.
Such a password has about 157 bits of entropy, which is far too big to be found by any kind of brute-force approach. Of course there are other ways that a password can be cracked, for example an attacker who breaks into the server can capture it as it is submitted. So it's still worth having a different password for each site.
> Such a password has about 157 bits of entropy, which is far too big to be found by any kind of brute-force approach.
To put this into perspective:
If you turned every grain of sand on Earth (about eight quintillion) into a computer able to test 1 trillion passwords per second, you'd need about 360 million years to exhaust half the search space and have better than even odds of guessing it.
Re: LinkedIn password leak
#94Earlier quoted context omitted.
password managers
Tinfoil hat time: if your password manager uses a bad generation scheme or backdoored RNG like Dual EC, then its passwords might be much easier to crack than they would appear. https://en.wikipedia.org/wiki/Dual_EC_DRBG
This is always my concern. At some point the password managers become an interesting attack vector.
Why can't people just be nice.
Re: LinkedIn password leak
#951: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…
[deleted]
Re: LinkedIn password leak
#96Earlier quoted context omitted.
So, being one of the people who hovers around laymanship when it comes to these questions, how hard is it to crack a randomly generated 25 character string with 5 digits and 5 symbols? This is typically what I would use for a website.
How do you randomly generate these passwords?
Personally, I like to use Diceware to create random character strings.
http://world.std.com/~reinhold/dicewarefaq.html#randomstring...
I even bought a set of casino dice.
Re: LinkedIn password leak
#971: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…
>> test sample passwords with our password checker > Seriously? Sample passwords, not your actual passwords. If you follow that link, they reinforce that with: "Never enter your real password".
Yes, that is the actual instructions that they give.
Imagine a relative of yours who is much less computer savvy than you are. What are the chances that the actually enter their real password?
And what value is this check, actually, on a fake password. "Your fake password will take xxx centuries to crack". So how does the non-tech savvy person, who might have a struggle coming up with a real, useful password, then enter one that is similar but not exact and expect a measured response?
So even if they collect "simulated" passwords, password cracking is less about entropy and more about generating dictionaries based on patterns that users are likely to use.
There isn't any value in such a site, and I claim it is less than useful.
Re: LinkedIn password leak
#98Earlier quoted context omitted.
No. Salting mostly prevents rainbow tables from being very useful, but rainbow tables are questionably useful anyway with modern hardware. (Obviously depending on the type of the hash)
Yeah but isn't this method just a giant rainbow table whose source is crawlable web content? >It would have been impossible to use a brute-force attack or even a combined dictionary to crack a phrase of that length. But because the phrase was contained in this Wikipedia article, it wound up in a word list that allowed Chrysannthou to crack the phrase in a matter of minutes.
No, a rainbow table is just a method to pre-compute hashes. Given that you can, for $500 buy a graphics card that can compute seven hundred million hashes a second, precomputation is not really of any value.
The attack described is to find potential passwords on the web or somewhere, compute the hash, see if it matches. Rainbow tables aren't any part of this process.
Re: LinkedIn password leak
#99Who cares if their LinkedIn account gets hacked? In my case they'll be able to see 500+ recruitment agents I've never heard of as my 'contacts'.
Password reuse, possible impersonation. If you work in a sensitive area, or deal with those who do, possible career, safety, or life risks.
Re: LinkedIn password leak
#100is it even verified that the data isn't again the warmed up stuff that surfaced from LinkedIn's 2012 breach? This is quite common these days.