Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lessons learned from cracking 2 million LinkedIn passwords

community.qualys.com

Post reply on HN
Print view View original

21–30 of 111 posts

Re: Lessons learned from cracking 2 million LinkedIn passwords

#21

Post by donutdan4114 »

I've always wondered why password hashing is not a law (at least in the US). There needs to be an agreed upon minimum level of security for storing credentials.

Or, just make it where websites HAVE to state somewhere how they are storing the credentials. It's shocking how many places still use plain text, or encryption and store the key in the database..

It's pathetic that a major company like LinkedIn is simply storing credentials with a SHA1 hash. At LEAST use a really good salt...

Re: Lessons learned from cracking 2 million LinkedIn passwords

#22

Post by ohgodthecat »

donutdan4114 wrote: post #17
baq wrote: post #4

Earlier quoted context omitted.

obligatory xkcd reference: http://xkcd.com/936/

I've always disagreed with this XKCD. Given a passphrase dictionary attack, the passphrase would be discovered in less than a minute. And technically, if you didn't know the format of the password, and you were just trying to get a random 11 character password, that would take a long time to crack. There are (roughly) 94 character that you could safely use for your password pretty much universally on any website... 9…

I see xkcd's passphrase is correcthorsebatterystaple and think that it is the wrong way to do it.

The memorization of that password would work much better than a simple passphrase like that.

I.E. the actual password would be:

    "That's a battery staple. Correct!"
And I don't believe that people will easily be able to crack that even with the minimal randomness that has been put in with current techniques. Sure if natural language cracking becomes popular you may have to become a little more creative like using a made up word or name or a number but even your example if no one knows what your password is:

    "My Phone number is (123) 546-8794."
should be sufficient for a very hard to crack password. And again is many times better than a simple dictionary passphrase with a few words combined.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#23

Post by jackalope »

dkokelley wrote: post #18
ams6110 wrote: post #2

no matter how elaborate a password you choose, as long as it is based on words and rules, even if there are many words and many rules, it will probably be cracked So this is what I've been wondering about the current "best practice" to use long passphrases. How are those really any stronger than any other "rule" based password, the "rule" being that they are likely constructed of words and phrases from human language…

Well, calculating the "true" strength is difficult to do, because even though sophisticated tools are available to aid the process, the attackers are still human, and can input their own guesses that may or may not be more accurate. If the attacker knows (or can closely guess) the password rules used to generate your password, he or she has a better chance of getting a hit. Let's look at a password like "My first car…

Beautifully written. Also worth noting is that sites exist that only use lower(trunc(password, 8), so your first 8 characters should be sufficiently random. For the grandparent, that leaves "my first", which is especially weak in a dictionary attack.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#24

Post by archivator »

jackalope wrote: post #20
runeks wrote: post #6

Here's a useful one-liner to create a strong password in Linux: cat /usr/share/dict/words|egrep -v "é|'s$|[Åå]|[Øø]"|shuf --random-source=/dev/random -n4 This uses the dictionary /usr/share/dict/words and skips all the words containing characters like é, å, ø and all those ending in 's . The resulting word list has 72,940 words in it. Then it chooses 4 random words from this dictionary and prints them to the screen.…

That's only 4 tokens and you should assume at least some of the combinations are already in rainbow tables. I don't know how long it would take to create a rainbow table for the whole space, which is this big: 72940^4 = 2.8304992 × 10^19 To put it in perspective, a 14-character password using only lower case English alphabet letters as individual tokens already beats this: 26^14 = 6.45099747 × 10^19

Then again, a random string of 14-characters is nearly impossible to remember.

The key takeaway here is that every word adds another 16.15 bits (assuming good random source and no non-random decisions by the user), whereas another character adds only 4.7 bits. I'd argue that the effort to remember another 4 random characters (to reach those 16 bits) is far more than the one to remember another random word. We're quite good with words, you know :)

Re: Lessons learned from cracking 2 million LinkedIn passwords

#25

Post by tedunangst »

ams6110 wrote: post #2

no matter how elaborate a password you choose, as long as it is based on words and rules, even if there are many words and many rules, it will probably be cracked So this is what I've been wondering about the current "best practice" to use long passphrases. How are those really any stronger than any other "rule" based password, the "rule" being that they are likely constructed of words and phrases from human language…

Your passphrase reduces to the password Mfcwa1MC. Is Mfcwa1MC easier to crack than a random 8 character password? Even if the attacker "half-cracked" your passphrase and knew its initials, there's still more work to do.

Making an intelligent phrase will affect the distribution of initials, but even something commonplace like "the quick brown zebra jumped over the mooon" or tqbzjotm hits the less frequent letters like q and z. It won't be completely random, but it's going to cover way more of the 8 letter space than words are.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#26

Post by tedunangst »

donutdan4114 wrote: post #21

I've always wondered why password hashing is not a law (at least in the US). There needs to be an agreed upon minimum level of security for storing credentials. Or, just make it where websites HAVE to state somewhere how they are storing the credentials. It's shocking how many places still use plain text, or encryption and store the key in the database.. It's pathetic that a major company like LinkedIn is simply stor…

Mandatory https isn't a law, either. Good thing or HN would be in violation of it.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#27

Post by Periodic »

runeks wrote: post #6

Here's a useful one-liner to create a strong password in Linux: cat /usr/share/dict/words|egrep -v "é|'s$|[Åå]|[Øø]"|shuf --random-source=/dev/random -n4 This uses the dictionary /usr/share/dict/words and skips all the words containing characters like é, å, ø and all those ending in 's . The resulting word list has 72,940 words in it. Then it chooses 4 random words from this dictionary and prints them to the screen.…

The unix utility apg has some nice functions for generating passwords. Particularly I like it's "pronounceable" algorithm which tries to generate passwords that are slightly pronounceable. It's a good way to get those 6-14 character passwords with numbers, upper case, and punctuation that are easier to remember but still random.

    WeampE6quaph (Weamp-E-SIX-quaph)
    2hoov2Klypfo (TWO-hoov-TWO-Klyp-fo)
    GicutOj8 (Gic-ut-Oj-EIGHT)
    HegEmWydwev5 (Heg-Em-Wyd-wev-FIVE)
    Tegdijetyik4 (Teg-dij-et-yik-FOUR)
    Fon7ochry (Fon-SEVEN-och-ry)
I usually take the password and type it about 100 times to see how it feels, subtly changing any characters that feel awkward to type. This gives me a password that is very fast and natural to type (less likely to have errors), but still has a lot of randomness and obeys all the stupid password rules.

Re: Lessons learned from cracking 2 million LinkedIn passwords

#28

Post by Periodic »

tedunangst wrote: post #19

I always use site specific, but also site derived passwords. I think it's time to reevaluate that practice. I remember seeing that three of the top password fragments for LinkedIn were link, job, and work. My password was all three... oops.

You might want to look at a browser extension like PwdHash [1]. It uses a client-side script to generate a cryptographic hash from your common password and the domain name. I've been using it for about four years now and have been generally very happy. It means that if my password ever gets leaked the attackers are not only unlikely to find my password of "ngjO3uBJrvt", but if they get it they do not have any information about other sites, even if I reuse the password elsewhere.

There are some newer password management/hashing tools. I've stuck with this one both because it works for me and I know and trust the authors, a group at Stanford.

1. https://www.pwdhash.com/

Re: Lessons learned from cracking 2 million LinkedIn passwords

#29

Post by dhughes »

Well it's to the point now where I can't remember my passwords they are so long and complex plus I have so many accounts I need a password manager to manage all of that.

With a password manager why bother restricting any password to anything less than the maximum? Gmail's password limit is 100 characters so I did that and any other account they are maxed out. Add to that extra authentication and also change them at least once every six month at minimum.

The problem is my most valuable account, my bank, is stuck 15 years in the past.

Post reply on HN