Lessons Learned From Cracking 2M LinkedIn Passwords

Posted by samzenpus on Monday June 11, 2012 @02:23AM from the listen-to-the-learnings dept.

An anonymous reader writes "Qualys researcher Francois Pesce used open source password cracker John the Ripper to try to crack SHA-1 hashes of leaked LinkedIn passwords. He ran the John the Ripper default command on a small default password dictionary of less than 4,000 words. The program then switched to incremental mode based on statistical analysis of known password structures, which generated more probable passwords. The results? After 4 hours, approximately 900,000 passwords had been cracked. Francois then ran numerous iterations, incorporating older dictionaries to uncover less common passwords and ended up cracking a total of 2,000,000 passwords."

1 of 198 comments (clear)

Min score:

Reason:

Sort:

gpg by Anonymous Coward · 2012-06-11 02:32 · Score: 5, Interesting

gpg - --gen-rand 1 9 | gpg -cat > linkedin.asc
And presto, 72 bits of sweet entropy in your password which you don't even need to remember. It suffices to remember ONE password.
Need your linkedin password?
gpg linkedin.asc | xsel
(and type your one password).
Note that this way your linkedin password is never typed and never shows up on the screen.