Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons learned from cracking 2 million LinkedIn passwords

community.qualys.com

Post reply on HN
Print view View original

71–80 of 111 posts

Re: Lessons learned from cracking 2 million LinkedIn passwords

#71

Post by saulrh »

0003 wrote: post #60
16s wrote: post #45

Linkedin allowed 6 character passwords. If a user selected six random uppercase ASCII, lowercase ASCII and numbers, this would be the bit-strength: print math.log(62) / math.log(2) * 6 35.72 bits That's easy to crack. Also, keep in mind that humans don't select chars randomly. So the bit-strength of these passwords was probably closer to 20 bits. I cracked 2.5 million with an old cpu and JtR within a few hours.

This is the advice I give to my family members. The solution is to create a one-time-pad in excel(!) that contains all of your passwords. Store it on an encrypted thumb drive and carry it with your keys. There is the possiblity that your OTP may contain a character set that is not congruent with a web-service's password system, but these circumstances are rare.

Just use keepass. If you're already carrying around a password file, you can carry around portable binaries of the program that reads your passwords.

www.keepass.info

Re: Lessons learned from cracking 2 million LinkedIn passwords

#72

Post by minikomi »

AgentConundrum wrote: post #11
ams6110 wrote: post #2

no matter how elaborate a password you choose, as long as it is based on words and rules, even if there are many words and many rules, it will probably be cracked So this is what I've been wondering about the current "best practice" to use long passphrases. How are those really any stronger than any other "rule" based password, the "rule" being that they are likely constructed of words and phrases from human language…

I have no idea. I thought they were, but your comment made be do some really naive analysis: For a typical password, each character can be one of around 92 characters, depending on what rules are in place - 26 lowercase letters, 26 uppercase letter, 10 digits, and ~32 special characters on the keyboard (I may have miscounted). Other characters could be used, but these are going to be the most common. This means that…

I might have to start throwing in a non-dictionary word here and there .. "Don't touch the Snorlax after 4:45" .. "The Grue desires my 25th Triforce" ..

Re: Lessons learned from cracking 2 million LinkedIn passwords

#73

Post by ralph »

Locke1689 wrote: post #69
runeks wrote: post #6

Here's a useful one-liner to create a strong password in Linux: cat /usr/share/dict/words|egrep -v "é|'s$|[Åå]|[Øø]"|shuf --random-source=/dev/random -n4 This uses the dictionary /usr/share/dict/words and skips all the words containing characters like é, å, ø and all those ending in 's . The resulting word list has 72,940 words in it. Then it chooses 4 random words from this dictionary and prints them to the screen.…

To generate random alphanumeric strings drop the following into your zshrc: function mkpw () { if (( $# == 0 )) then head /dev/urandom | uuencode -m - | sed -n 2p | cut -c1-${1:-12} else head /dev/urandom | uuencode -m - | sed -n 2p | cut -c1-${1:-$1} fi } By default it generates an alphanumeric string of length 12. Given an integer argument n it generates an alphanumeric string of length n.

Why the test of both $# and $1?

    tr -dc '!-~'
Change to A-Za-z0-9, etc., to suit.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#74

Post by MetaCosm »

This week has finally got me off my ass, and I generated a truly random password for all 260 sites I have built-up in Lastpass over the past few years... as well strong Lastpass password (most likely going to be hardened with a two-factor via Yubikey in the near future).

I must say, just finding the password reset function on some of these forums and less popular sites is a beast. Also, I was shocked by the number of 10 and 12 char limitations I hit.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#75

Post by FixThisPOSSite »

ams6110 wrote: post #2

no matter how elaborate a password you choose, as long as it is based on words and rules, even if there are many words and many rules, it will probably be cracked So this is what I've been wondering about the current "best practice" to use long passphrases. How are those really any stronger than any other "rule" based password, the "rule" being that they are likely constructed of words and phrases from human language…

Another best practice is to avoid the worst practice - forcing people to use E-mail addresses as user IDs: http://goldmanosi.blogspot.com/2012/06/forcing-people-to-use...

Re: Lessons learned from cracking 2 million LinkedIn passwords

#76

Post by jackalope »

JD557 wrote: post #67
jackalope wrote: post #23

Earlier quoted context omitted.

Beautifully written. Also worth noting is that sites exist that only use lower(trunc(password, 8), so your first 8 characters should be sufficiently random. For the grandparent, that leaves "my first", which is especially weak in a dictionary attack.

I don't get it. Is there a reason for some sites to actually do that? (considering that they don't store your password as plaintext) I guess if someone stole their database it would be impossible to know your real password, but still... Or am I missing something here?

Some sites lowercase all passwords after they are input to "help" users who hit caps lock or are otherwise challenged by case sensitivity. Then you have DES crypt (as once used by Gawker), which only uses the first 8 characters of the password. A site which uses either or both of these methods may happily let you type in a password of any length or complexity, but the version they use will have significantly lower entropy. I've even seen sites silently strip special characters.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#77

Post by tedunangst »

simonbrown wrote: post #61
simonbrown wrote: post #44

Earlier quoted context omitted.

So?

To be clearer, my point was that HN not using HTTPS doesn't seem like a reason not to require sites to use HTTPS, let alone introducing any security regulations at all.

To be clear myself, the point is that there are bigger fish to fry. Mandating one practice when we can't even implement another smells like issue of the week.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#78

Post by tedunangst »

ycombinatorr wrote: post #62
tedunangst wrote: post #19

I always use site specific, but also site derived passwords. I think it's time to reevaluate that practice. I remember seeing that three of the top password fragments for LinkedIn were link, job, and work. My password was all three... oops.

So the saying that OpenBSD developers are paranoid is not true after all?

I think openbsd developers are better than most at realistic threat assessment. :)

Re: Lessons learned from cracking 2 million LinkedIn passwords

#79

Post by rargulati »

minikomi wrote: post #72
AgentConundrum wrote: post #11

Earlier quoted context omitted.

I have no idea. I thought they were, but your comment made be do some really naive analysis: For a typical password, each character can be one of around 92 characters, depending on what rules are in place - 26 lowercase letters, 26 uppercase letter, 10 digits, and ~32 special characters on the keyboard (I may have miscounted). Other characters could be used, but these are going to be the most common. This means that…

I might have to start throwing in a non-dictionary word here and there .. "Don't touch the Snorlax after 4:45" .. "The Grue desires my 25th Triforce" ..

Forget your rainbow tables and bring a pokedex!

Re: Lessons learned from cracking 2 million LinkedIn passwords

#80

Post by chmike »

fl3tch wrote: post #57
gambler wrote: post #55

Thus, it is highly recommended to use a strong random password generator that is known to be actually random. The whole point of a password is that you can remember it. The moment you need software to store and retrieve passwords, you're better off using asymmetric cryptography. That said, I really dislike the idea that it's the only way to achieve security. I would really like to see more discussions and proposition…

It will get to the point that we need biometric scanners or implanted RFID chips with private keys to do authentication, since brute forcing even unrememberable passwords will be trivial eventually.

As Bruce Schneir said about this, if your biometric "key" is compromized there is no way for you to change it.
Post reply on HN