Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons learned from cracking 2 million LinkedIn passwords

community.qualys.com

Post reply on HN
Print view View original

31–40 of 111 posts

Re: Lessons learned from cracking 2 million LinkedIn passwords

#31

Post by Periodic »

donutdan4114 wrote: post #21

I've always wondered why password hashing is not a law (at least in the US). There needs to be an agreed upon minimum level of security for storing credentials. Or, just make it where websites HAVE to state somewhere how they are storing the credentials. It's shocking how many places still use plain text, or encryption and store the key in the database.. It's pathetic that a major company like LinkedIn is simply stor…

There are problems with mandating standards. Mostly because they change a lot and will cause undue overhead to many companies. The government (NIST) already publishes standards, there is just no mandate that you use them.

example: http://csrc.nist.gov/publications/drafts/800-118/draft-sp800...

Re: Lessons learned from cracking 2 million LinkedIn passwords

#32

Post by Someone »

dkokelley wrote: post #18
ams6110 wrote: post #2

no matter how elaborate a password you choose, as long as it is based on words and rules, even if there are many words and many rules, it will probably be cracked So this is what I've been wondering about the current "best practice" to use long passphrases. How are those really any stronger than any other "rule" based password, the "rule" being that they are likely constructed of words and phrases from human language…

Well, calculating the "true" strength is difficult to do, because even though sophisticated tools are available to aid the process, the attackers are still human, and can input their own guesses that may or may not be more accurate. If the attacker knows (or can closely guess) the password rules used to generate your password, he or she has a better chance of getting a hit. Let's look at a password like "My first car…

One improvement: for most people, the risk is not that someone tries to crack your password, it is that someone uses rainbow tables to crack many passwords, one of which may be yours.

Rainbow tables have a degree of freedom: the function that maps hashes back to passwords. You should try and pick a password that that function will never generate. To get that, do something unique. Good options, I think, are including a foreign language word (neither English nor your native language, nor the site's language), reversing a word or a syllable inside it, and made up words that have Hamming distance greater than two to any other 'obvious' word.

Short (Disclaimer: I have never looked what kind of code commonly used rainbow tables use.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#33

Post by leot »

donutdan4114 wrote: post #17
baq wrote: post #4

Earlier quoted context omitted.

obligatory xkcd reference: http://xkcd.com/936/

I've always disagreed with this XKCD. Given a passphrase dictionary attack, the passphrase would be discovered in less than a minute. And technically, if you didn't know the format of the password, and you were just trying to get a random 11 character password, that would take a long time to crack. There are (roughly) 94 character that you could safely use for your password pretty much universally on any website... 9…

Given a passphrase dictionary attack, the passphrase would be discovered in less than a minute.

Wait, what?

2,048^4 == 2^44 == 17,592,186,044,416

At 2 million hashes/second it would still take 101 [edit: actually, on average, 50] days to find this password, if it was unsalted. Perhaps if you had spent a few years of supercomputer time to generate some massive rainbow tables, you might be able to discover it quickly, but absent the need for your linkedIn password to be resistant to attacks from a nation state, you'd be pretty safe with such a password for a while.

It's entirely unclear how you came to the conclusion that it could be discovered in "under a minute" with a passphrase dictionary attack.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#34

Post by SkyMarshal »

donutdan4114 wrote: post #21

I've always wondered why password hashing is not a law (at least in the US). There needs to be an agreed upon minimum level of security for storing credentials. Or, just make it where websites HAVE to state somewhere how they are storing the credentials. It's shocking how many places still use plain text, or encryption and store the key in the database.. It's pathetic that a major company like LinkedIn is simply stor…

>Or, just make it where websites HAVE to state somewhere how they are storing the credentials. It's shocking how many places still use plain text, or encryption and store the key in the database..

I like this idea. Like a Surgeon General's Warning for the web. I wouldn't want the government making specific laws about hashing, but requiring transparency and disclosure about how data is stored would be useful in a variety of ways.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#35

Post by robomartin »

With all this talk about security I am still wondering why everyone isn't up in arms about the fact that Chrome makes all of your stored passwords plainly visible at the click of a button or two. This has been the case for years and many complaints have been recorded, but Google, for some strange reasons, seems to refuse to even attempt to put forth any effort to secure their browser.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#36

Post by lotharbot »

ams6110 wrote: post #10
runeks wrote: post #6

Here's a useful one-liner to create a strong password in Linux: cat /usr/share/dict/words|egrep -v "é|'s$|[Åå]|[Øø]"|shuf --random-source=/dev/random -n4 This uses the dictionary /usr/share/dict/words and skips all the words containing characters like é, å, ø and all those ending in 's . The resulting word list has 72,940 words in it. Then it chooses 4 random words from this dictionary and prints them to the screen.…

yes, but picking a handful of random words out of the dictionary is not the advice the passphrase advocates are giving. They are saying use a phrase that's meaningful to you and easy to remember.... which means most people are going to use a phrase in their native tongue, just like most people are using passwords like "mylinkedin!" for linked in. Edit: also, for anyone wanting something like the above technique, I re…

> "They are saying use a phrase that's meaningful to you"

I haven't seen any passphrase advocates say that.

The ones I've seen all say "use 4-5 random dictionary words". Come up with a meaning for the phrase, and it'll be easy to remember.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#37

Post by tedunangst »

Periodic wrote: post #28
tedunangst wrote: post #19

I always use site specific, but also site derived passwords. I think it's time to reevaluate that practice. I remember seeing that three of the top password fragments for LinkedIn were link, job, and work. My password was all three... oops.

You might want to look at a browser extension like PwdHash [1]. It uses a client-side script to generate a cryptographic hash from your common password and the domain name. I've been using it for about four years now and have been generally very happy. It means that if my password ever gets leaked the attackers are not only unlikely to find my password of "ngjO3uBJrvt", but if they get it they do not have any informa…

I don't use that because of (unfounded) concerns that I will someday need to enter my password into some device where it's not available, or the domain will change, or some other scenario where bad things will happen because I do not actually know the password I told the site.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#38

Post by abraham »

robomartin wrote: post #35

With all this talk about security I am still wondering why everyone isn't up in arms about the fact that Chrome makes all of your stored passwords plainly visible at the click of a button or two. This has been the case for years and many complaints have been recorded, but Google, for some strange reasons, seems to refuse to even attempt to put forth any effort to secure their browser.

There are going to be much better discussions about this in Chromium discussion archives but I'll cover one of the main reasons why Chrome and Firefox (by default) do not have a master password. If someone has physical or remote access to your computer it is an endgame scenario and it does not matter if you have a master password enabled or not. The most basic attack is just to install a keylogger and steal the master password. They could also just copy the password database remotely and brute force it.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#39

Post by wahnfrieden »

robomartin wrote: post #35

With all this talk about security I am still wondering why everyone isn't up in arms about the fact that Chrome makes all of your stored passwords plainly visible at the click of a button or two. This has been the case for years and many complaints have been recorded, but Google, for some strange reasons, seems to refuse to even attempt to put forth any effort to secure their browser.

Just to be clear, any security they could put on top of that would only be a deterrent to inept or non-criminal-minded people since encrypting those passwords is reversible and not allowing them to be seen inside Chrome wouldn't stop other tools. One alternative is to require a password to unlock the keychain, but I suspect most people don't actually want that (to have to type in a password in order to allow Chrome to autofill a password for them).
Post reply on HN