Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LinkedIn password leak

usblog.kaspersky.com

Post reply on HN
Print view View original

181–190 of 218 posts

Re: LinkedIn password leak

#181

Post by yoha »

Ntrails wrote: post #179
yoha wrote: post #165

Earlier quoted context omitted.

The worst bias is letting the users choose their passwords. They should use a generator such as [1]. The reason is that the "entropy" is not a characteristic of a password but of the way it is generated. Computers are much better at entropy than humans. [1] http://passwordcreator.org/

Work sent around a stupid cardboard stand which was supposed to tell us all about being excellent at our work, and the checking processes required before sending anything to clients etc etc. We were changing domains at the same time, so my new password root is now based on the first three characters of the first 3 lines of the thing, which included some punctuation, then the standard numeral to increment every 90 day…

However, such an approach corresponds to a few dozens bits of entropy at best (some for the approach, some for the length of text used, and a few for the numeral depending on whence it comes).

As stated by zamalek, the trick to not memorizing many passwords is to use a password manager.

Re: LinkedIn password leak

#182

Post by yoha »

zamalek wrote: post #172
yoha wrote: post #165

Earlier quoted context omitted.

The worst bias is letting the users choose their passwords. They should use a generator such as [1]. The reason is that the "entropy" is not a characteristic of a password but of the way it is generated. Computers are much better at entropy than humans. [1] http://passwordcreator.org/

Or, better yet, a password manager. If you aren't using one yet, now is a great opportunity.

I agree that password managers are great. They let you use completely different passwords for each service, efficiently mitigating any compromise. Also, they tend to encourage you to use actually random passwords (using a generator).

However, most users will not bother, and getting them to use at least decent passwords would be a great step forward. Additionally, you still need a master password for your password manager.

Re: LinkedIn password leak

#183

Post by warrenpj »

The best security that an individual can get from passwords is clearly achieved by using a password manager and generating a unique random password for each site, and changing high-value passwords periodically. (It's arguably already impossible for a human to generate or remember enough good passwords, and either way it gets harder as computers get better at guessing human-generated passwords.)

However, from the point of view of someone implementing an authentication system, passwords on their own are broken. There will be a significant fraction of users who re-use their password at a site with minimal-effort security. If you subscribe to the idea that computer professionals have a moral duty to safeguard people's private information entrusted to them, then password-only authentication is just broken.

The solution is to either: spend the money to implement a multiple factor authentication system (with a secure password database and fraud detection) or use a federated identity service. (Even just sending a one-time login code via email is fine). The latter is simple and takes even less effort than implementing a password system from scratch.

There should be fines (at the very least) for having an unsalted password database with more than X number of users.

Re: LinkedIn password leak

#184

Post by ryanlol »

forgotpwtomain wrote: post #145
pdq wrote: post #18

Earlier quoted context omitted.

Link: https://password.kaspersky.com/ I'm impressed by the password cracking estimation with the Tianhe-2 Supercomputer. A 10-character password containing uppercase letters, lowercase letters, and numbers, which is estimated at a 4 year crack with a Macbook Pro, takes 31 seconds on the supercomputer.

62^10 > 2^58. At 2^58 that would take ~ 2.28E+09 guesses per second - I'm really not buying this.

2.28E+09 is only a tiny fraction of what modern desktop computers can do against weaker hashes/

Mine easily hits 80Ghash/s on MD5 and around 25Ghash/s on SHA1, a more dedicated setup could easily do 10x that.

Re: LinkedIn password leak

#185

Post by ryanlol »

adriancooney wrote: post #81
jlgaddis wrote: post #34

Earlier quoted context omitted.

Unsalted SHA1.

This is just unforgivable. This is such an incredibly basic and simple to implement feature and they've just ignored it. There should be some legal repercussions for companies neglecting security. When they surpass 100,000 users, a mandatory security audit should be passed (like a health and safety inspection). Data breaches like these just happen far too often.

Hardly, in reality salting simply doesn't make much of a difference. It's the algorithm used that matters here.

Re: LinkedIn password leak

#186

Post by forgotpwtomain »

ryanlol wrote: post #184
forgotpwtomain wrote: post #145

Earlier quoted context omitted.

62^10 > 2^58. At 2^58 that would take ~ 2.28E+09 guesses per second - I'm really not buying this.

2.28E+09 is only a tiny fraction of what modern desktop computers can do against weaker hashes/ Mine easily hits 80Ghash/s on MD5 and around 25Ghash/s on SHA1, a more dedicated setup could easily do 10x that.

Passwords hashed with a single iteration; not to mention SHA1 - seriously? (bcrypt should be around 100ms)

Re: LinkedIn password leak

#187

Post by bad_user »

LeoPanthera wrote: post #90
newman314 wrote: post #87

Earlier quoted context omitted.

Why not?

I don't like that you have to specify a fixed number of numbers, special chars, etc.

I think that's cool from a UI perspective, having that control, because for some services you still want typing to be doable.

I mean, try typing this on your PC or mobile phone: &}n9$r}@pe^q;j2U33Aq8.kTa}Z2^ykQ

And compare it with this one: dn#Ze39h644s9DdTpaxRaWW&m33Vy98b

And yes, their client saves you somewhat, except that there are plenty of instances in which you resort to copy/pasting passwords. Like on Android where the integration is poor. And on the desktop as well. And guess what, copy/paste is really, really insecure, because apps can be made to listen to clipboard events, so you can have apps that are logging whatever you copy/paste. Oh, and Linux doesn't have 1Password, their old Windows client is getting replaced with a "modern Windows" app, so tough luck.

Re: LinkedIn password leak

#188

Post by nyir »

warrenpj wrote: post #183

The best security that an individual can get from passwords is clearly achieved by using a password manager and generating a unique random password for each site, and changing high-value passwords periodically. (It's arguably already impossible for a human to generate or remember enough good passwords, and either way it gets harder as computers get better at guessing human-generated passwords.) However, from the poin…

Or for an unhashed password database, c.f. http://plaintextoffenders.com/.

Re: LinkedIn password leak

#189

Post by ryanlol »

forgotpwtomain wrote: post #186
ryanlol wrote: post #184

Earlier quoted context omitted.

2.28E+09 is only a tiny fraction of what modern desktop computers can do against weaker hashes/ Mine easily hits 80Ghash/s on MD5 and around 25Ghash/s on SHA1, a more dedicated setup could easily do 10x that.

Passwords hashed with a single iteration; not to mention SHA1 - seriously? (bcrypt should be around 100ms)

I'll worry about bcrypt when people start using it.

Re: LinkedIn password leak

#190

Post by unlinker »

nyir wrote: post #188
warrenpj wrote: post #183

The best security that an individual can get from passwords is clearly achieved by using a password manager and generating a unique random password for each site, and changing high-value passwords periodically. (It's arguably already impossible for a human to generate or remember enough good passwords, and either way it gets harder as computers get better at guessing human-generated passwords.) However, from the poin…

Or for an unhashed password database, c.f. http://plaintextoffenders.com/ .

The fact that your password is mailed in plain text to you when you register does not prove the password is not hashed when it's stored.

In a "lost password" mail, of course, that's another thing.

Post reply on HN