Lessons learned from cracking 2 million LinkedIn passwords • Hacker News Board

Re: Lessons learned from cracking 2 million LinkedIn passwords

#41

Post by 16s » Sun, Jun 10, 2012, 6:12 PM UTC

dhughes wrote: post #29

Well it's to the point now where I can't remember my passwords they are so long and complex plus I have so many accounts I need a password manager to manage all of that. With a password manager why bother restricting any password to anything less than the maximum? Gmail's password limit is 100 characters so I did that and any other account they are maxed out. Add to that extra authentication and also change them at l…

That because somewhere in the bank, they still have mainframes in use and old Unisys guys are on call to support them ;)

Re: Lessons learned from cracking 2 million LinkedIn passwords

#42

Post by napum » Sun, Jun 10, 2012, 6:13 PM UTC

robomartin wrote: post #35

With all this talk about security I am still wondering why everyone isn't up in arms about the fact that Chrome makes all of your stored passwords plainly visible at the click of a button or two. This has been the case for years and many complaints have been recorded, but Google, for some strange reasons, seems to refuse to even attempt to put forth any effort to secure their browser.

A browser needs access to your raw password or it wouldn't be able to send it to a website. You could take Chrome to just not remember your passwords if it'd make you feel better. And alternative could be the master password feat but I'm not sure how that option works. I'm assuming (and this is dangerous) that it encrypts your passwords with your master password and decrypts them after you've entered that password.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#43

Post by SCdF » Sun, Jun 10, 2012, 6:25 PM UTC

dhughes wrote: post #29

Well it's to the point now where I can't remember my passwords they are so long and complex plus I have so many accounts I need a password manager to manage all of that. With a password manager why bother restricting any password to anything less than the maximum? Gmail's password limit is 100 characters so I did that and any other account they are maxed out. Add to that extra authentication and also change them at l…

I've done the same, though I tend to limit it at about 24 characters, simply because if I come across a situation where I have to type it on a foreign computer while reading the password from the password manager on my phone, I don't want to be there all week..

Re: Lessons learned from cracking 2 million LinkedIn passwords

#44

Post by simonbrown » Sun, Jun 10, 2012, 6:27 PM UTC

tedunangst wrote: post #26

donutdan4114 wrote: post #21

I've always wondered why password hashing is not a law (at least in the US). There needs to be an agreed upon minimum level of security for storing credentials. Or, just make it where websites HAVE to state somewhere how they are storing the credentials. It's shocking how many places still use plain text, or encryption and store the key in the database.. It's pathetic that a major company like LinkedIn is simply stor…

Mandatory https isn't a law, either. Good thing or HN would be in violation of it.

So?

Re: Lessons learned from cracking 2 million LinkedIn passwords

#45

Post by 16s » Sun, Jun 10, 2012, 6:40 PM UTC

Linkedin allowed 6 character passwords. If a user selected six random uppercase ASCII, lowercase ASCII and numbers, this would be the bit-strength:

print math.log(62) / math.log(2) * 6

35.72 bits

That's easy to crack. Also, keep in mind that humans don't select chars randomly. So the bit-strength of these passwords was probably closer to 20 bits. I cracked 2.5 million with an old cpu and JtR within a few hours.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#46

Post by ronnier » Sun, Jun 10, 2012, 6:41 PM UTC

Were these just password hashes or did the leak include usernames and/or email addresses?

Re: Lessons learned from cracking 2 million LinkedIn passwords

#47

Post by seandougall » Sun, Jun 10, 2012, 6:45 PM UTC

runeks wrote: post #6

Here's a useful one-liner to create a strong password in Linux: cat /usr/share/dict/words|egrep -v "é|'s$|[Åå]|[Øø]"|shuf --random-source=/dev/random -n4 This uses the dictionary /usr/share/dict/words and skips all the words containing characters like é, å, ø and all those ending in 's . The resulting word list has 72,940 words in it. Then it chooses 4 random words from this dictionary and prints them to the screen.…

It should be noted that if you use the same passphrase for your most important things, then it may not matter how uncrackable it is -- if it gets compromised through a method other than cracking, then all your other important accounts are also compromised.

Even relatively high-stakes companies like banks and credit card companies make obscenely stupid mistakes when it comes to security. For example, there was a case fairly recently where you could log into your Citibank account and change the account number in the GET query string, and you'd instantly have access to anybody else's account. Given that they're capable of that type of idiocy, all it takes is for one mental giant to decide that encrypting your password is better than hashing it, and you're vulnerable.

Malicious behavior isn't the only thing to watch out for. By doing business with the outside world, we're putting ourselves at the mercy of complete morons every day. If you use a different passphrase for every account, then you can at least limit your risk to one service.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#48

Post by josso » Sun, Jun 10, 2012, 6:46 PM UTC

ronnier wrote: post #46

Were these just password hashes or did the leak include usernames and/or email addresses?

The file that got leaked to the public is only containing the hashes. The hackers behind the file probably has usernames or emails.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#49

Post by Rubenb » Sun, Jun 10, 2012, 6:46 PM UTC

robomartin wrote: post #35

With all this talk about security I am still wondering why everyone isn't up in arms about the fact that Chrome makes all of your stored passwords plainly visible at the click of a button or two. This has been the case for years and many complaints have been recorded, but Google, for some strange reasons, seems to refuse to even attempt to put forth any effort to secure their browser.

In OS X Chrome stores passwords in your keychain. If you lock it then you have to enter your password before Chrome has access to the passwords.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#50

Post by rphlx » Sun, Jun 10, 2012, 6:50 PM UTC

leot wrote: post #33

donutdan4114 wrote: post #17

Earlier quoted context omitted.

I've always disagreed with this XKCD. Given a passphrase dictionary attack, the passphrase would be discovered in less than a minute. And technically, if you didn't know the format of the password, and you were just trying to get a random 11 character password, that would take a long time to crack. There are (roughly) 94 character that you could safely use for your password pretty much universally on any website... 9…

Given a passphrase dictionary attack, the passphrase would be discovered in less than a minute. Wait, what? 2,048^4 == 2^44 == 17,592,186,044,416 At 2 million hashes/second it would still take 101 [edit: actually, on average, 50] days to find this password, if it was unsalted. Perhaps if you had spent a few years of supercomputer time to generate some massive rainbow tables, you might be able to discover it quickly,…

Diverging from your main point a bit: 2MH/s is unrealistically low. For a couple thousand dollars you can build FPGA HW that can do several billion SHA1 hashes/s. The bitcoin mining world is getting 400-450 SHA256 MH/s from a $130 chip. With similar technology, you can brute force a 2^44 SHA1 space in a lot less than 50 days.