Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons learned from cracking 2 million LinkedIn passwords

community.qualys.com

Post reply on HN
Print view View original

101–110 of 111 posts

Re: Lessons learned from cracking 2 million LinkedIn passwords

#101

Post by bandy »

Someone wrote: post #32
dkokelley wrote: post #18

Earlier quoted context omitted.

Well, calculating the "true" strength is difficult to do, because even though sophisticated tools are available to aid the process, the attackers are still human, and can input their own guesses that may or may not be more accurate. If the attacker knows (or can closely guess) the password rules used to generate your password, he or she has a better chance of getting a hit. Let's look at a password like "My first car…

One improvement: for most people, the risk is not that someone tries to crack your password, it is that someone uses rainbow tables to crack many passwords, one of which may be yours. Rainbow tables have a degree of freedom: the function that maps hashes back to passwords. You should try and pick a password that that function will never generate. To get that, do something unique. Good options, I think, are including…

And a lot of systems (i.e. linux) will reject it as a "dictionary word", even if such words don't appear in its dictionary. Such a password in an obscure foreign language isn't going to be cracked until someone starts doing a full-space search, which is still very difficult once you have more than 8 characters, yet it will still be rejected.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#102

Post by SkyMarshal »

krrrh wrote: post #51
SkyMarshal wrote: post #34

Earlier quoted context omitted.

>Or, just make it where websites HAVE to state somewhere how they are storing the credentials. It's shocking how many places still use plain text, or encryption and store the key in the database.. I like this idea. Like a Surgeon General's Warning for the web. I wouldn't want the government making specific laws about hashing, but requiring transparency and disclosure about how data is stored would be useful in a vari…

The concern I have with this is that it provides a bit too much information to potential crackers. Security through obscurity is nothing to rely in, but it doesn't hurt to have a little. It's why disabling the reporting of http server version information is a common practice in hardening a server. OTOH, it may be worth it. It's shocking that LinkedIn could be so negligent, especially after high-profile screwups like…

>The concern I have with this is that it provides a bit too much information to potential crackers.

Only the script kiddies. The ones you have to worry about have bots and automated scans that can figure that stuff out in an instant.

Yeah, unbelievably shocking that such an advanced web company as LinkedIn could be so negligent. Amateur bitcoin sites, social media sites, venerable Web 1.0 ones like Last.fm don't surprise me much, but LinkedIn? WTF.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#103

Post by Someone »

nodata wrote: post #86
Someone wrote: post #32

Earlier quoted context omitted.

One improvement: for most people, the risk is not that someone tries to crack your password, it is that someone uses rainbow tables to crack many passwords, one of which may be yours. Rainbow tables have a degree of freedom: the function that maps hashes back to passwords. You should try and pick a password that that function will never generate. To get that, do something unique. Good options, I think, are including…

I thought GPUs killed rainbow tables? (the storage space alone makes them impractical compared to cracking realtime)

Not that that says much, but I am not aware of that. More importantly, googling for "GPU vs rainbow table" leads me to phrases such as "a fully GPU accelerated set of rainbow table tools". Or has the term changed meaning?

Re: Lessons learned from cracking 2 million LinkedIn passwords

#104

Post by abraham »

robomartin wrote: post #81
abraham wrote: post #38

Earlier quoted context omitted.

There are going to be much better discussions about this in Chromium discussion archives but I'll cover one of the main reasons why Chrome and Firefox (by default) do not have a master password. If someone has physical or remote access to your computer it is an endgame scenario and it does not matter if you have a master password enabled or not. The most basic attack is just to install a keylogger and steal the maste…

I understand this very well. Here's one scenario: Busy office. Hundreds of computers. Open environment (no doors, just a bunch of desks/tables). Everyone using Chrome. The current version of Chrome would allow someone to, within a few clicks, grab a pile of passwords. Here's another scenario: Your mother takes her laptop to be repaired/updated. She uses Chrome. The entire repair shop has easy, unencumbered access to…

> The current version of Chrome would allow someone to, within a few clicks, grab a pile of passwords

With a USB stick and one click anyone can install malware that would give complete control of the computer to the user remotely.

> Computer goes to IT guy where you work for repairs/updates.

IT repair guys generally need admin access to the computer and will have all the time in the world to install any number of malware for remote access.

> but what Chrome does today is, in my opinion, at the very least irresponsible

For Chrome to add a master password would be irresponsible because it would give users the illusion of security they don't have. All OSes already have password protection against innocent peeking with user accounts and the ability to lock your computer when you walk away.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#105

Post by QWDEQWEQWE »

dkokelley wrote: post #18
ams6110 wrote: post #2

no matter how elaborate a password you choose, as long as it is based on words and rules, even if there are many words and many rules, it will probably be cracked So this is what I've been wondering about the current "best practice" to use long passphrases. How are those really any stronger than any other "rule" based password, the "rule" being that they are likely constructed of words and phrases from human language…

Well, calculating the "true" strength is difficult to do, because even though sophisticated tools are available to aid the process, the attackers are still human, and can input their own guesses that may or may not be more accurate. If the attacker knows (or can closely guess) the password rules used to generate your password, he or she has a better chance of getting a hit. Let's look at a password like "My first car…

http://www.bestwatchsale.net Watches Inc is known as the professional replica watches supplier, offer the high quality imitation watches from Rolex, Omega, Breitling,

Re: Lessons learned from cracking 2 million LinkedIn passwords

#106

Post by nodata »

Someone wrote: post #103
nodata wrote: post #86

Earlier quoted context omitted.

I thought GPUs killed rainbow tables? (the storage space alone makes them impractical compared to cracking realtime)

Not that that says much, but I am not aware of that. More importantly, googling for "GPU vs rainbow table" leads me to phrases such as "a fully GPU accelerated set of rainbow table tools". Or has the term changed meaning?

These links are good:

http://news.ycombinator.com/item?id=3140614

http://news.ycombinator.com/item?id=4073597

Re: Lessons learned from cracking 2 million LinkedIn passwords

#107

Post by dopo »

LinXitoW wrote: post #90
saulrh wrote: post #71

Earlier quoted context omitted.

Just use keepass. If you're already carrying around a password file, you can carry around portable binaries of the program that reads your passwords. www.keepass.info

sadly, Keepass is not very Mac/Linux friendly, because it's built on .NET, so it's only an option for pure Windows users.

I don't know about Linux, but I've been using KeePassX for Mac for about a year now. It only supports the older KeePass file format, and it's ugly, but it works great. There are also a few iOS apps you can use, my favorite of which is KyPass.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#108

Post by wazoox »

waffle_ss wrote: post #13
runeks wrote: post #6

Here's a useful one-liner to create a strong password in Linux: cat /usr/share/dict/words|egrep -v "é|'s$|[Åå]|[Øø]"|shuf --random-source=/dev/random -n4 This uses the dictionary /usr/share/dict/words and skips all the words containing characters like é, å, ø and all those ending in 's . The resulting word list has 72,940 words in it. Then it chooses 4 random words from this dictionary and prints them to the screen.…

Cool! You don't need to use cat, though: egrep -v "é|'s$|[Åå]|[Øø]" /usr/share/dict/words|shuf --random-source=/dev/random -n4

UUOC. It even has its own several web pages. Start there:

http://en.wikipedia.org/wiki/Cat_%28Unix%29#Useless_use_of_c...

Re: Lessons learned from cracking 2 million LinkedIn passwords

#109

Post by tripzilch »

JD557 wrote: post #67
jackalope wrote: post #23

Earlier quoted context omitted.

Beautifully written. Also worth noting is that sites exist that only use lower(trunc(password, 8), so your first 8 characters should be sufficiently random. For the grandparent, that leaves "my first", which is especially weak in a dictionary attack.

I don't get it. Is there a reason for some sites to actually do that? (considering that they don't store your password as plaintext) I guess if someone stole their database it would be impossible to know your real password, but still... Or am I missing something here?

> I don't get it. Is there a reason for some sites to actually do that?

Yes it's to save space ...

No, wait.

It's so they don't use all the CPU power ...

No, not that either.

It's because the programmer didn't want to use their braincells.

Yeah, that would be it.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#110

Post by tripzilch »

nuttendorfer wrote: post #5
ams6110 wrote: post #2

no matter how elaborate a password you choose, as long as it is based on words and rules, even if there are many words and many rules, it will probably be cracked So this is what I've been wondering about the current "best practice" to use long passphrases. How are those really any stronger than any other "rule" based password, the "rule" being that they are likely constructed of words and phrases from human language…

They way I see it, and I'm no expert on this topic, a longer password is better than a short, completely random one. The attacker doesn't know how long your password is, so he will start with short passwords. Each additional character adds a lot more possible combinations, so thats where you get your safety from. Now if you include lower/upper case letters, digits and special characters you have increased the search…

> They way I see it, and I'm no expert on this topic, a longer password is better than a short, completely random one. The attacker doesn't know how long your password is, so he will start with short passwords.

Did you read the article? It describes exactly what a possible attacker does. And it's not "start with short passwords".

There's only two options:

- Use a really random password string, from a non-broken random generator

- Do something nobody else does

The latter only works if you can stop yourself from bragging about it on public fora. Which is why one of the best pieces of advice for secure passphrases is to include something really, really embarrassing, horrible, shameful, completely unfit for print and absolutely boring. Especially don't use a funny quip or play on words, don't try to be clever, there ought to be no audience to appreciate it. And if at all possible it shouldn't even look like a password.

(kinda OT) I read that advice many years ago, and I don't understand why Julian Assange did not take it to heart. Remember when that Guardian journalist wrote his book and published the passphrase to that AES encrypted data dump (because the nitwit assumed the AES passphrase would be automatically invalidated after a few hours ...), it was something like "a diplomatic history from " with some random uppercasing, special characters, etc. It would have been pretty strong, except it was WAY too clever and typical-super-secret-password-looking to use for the sort of hypersensitive data Assange was carrying about. If he had simply picked some terribly bad and misspelled slashfic involving Martin Luther King, a dead baby and pres. Nixon--like Spider Jerusalem would've done--no way the Guardian journalist would have published that, anywhere.

Post reply on HN