Slashdot Mirror

← Back to Stories (view on slashdot.org)

Lessons Learned From Cracking 2M LinkedIn Passwords

Posted by samzenpus on from the listen-to-the-learnings dept.

An anonymous reader writes "Qualys researcher Francois Pesce used open source password cracker John the Ripper to try to crack SHA-1 hashes of leaked LinkedIn passwords. He ran the John the Ripper default command on a small default password dictionary of less than 4,000 words. The program then switched to incremental mode based on statistical analysis of known password structures, which generated more probable passwords. The results? After 4 hours, approximately 900,000 passwords had been cracked. Francois then ran numerous iterations, incorporating older dictionaries to uncover less common passwords and ended up cracking a total of 2,000,000 passwords."

8 of 198 comments (clear)

  1. Do not use standard passwords by Anonymous Coward · · Score: 5, Insightful

    Surely this is not news.

    1. Re:Do not use standard passwords by Shetan · · Score: 5, Informative

      So what next?

      Two factor authentication.

    2. Re:Do not use standard passwords by ShanghaiBill · · Score: 5, Informative

      Salting doesn't stop brute force crackers like JtR

      Salting doesn't make brute force crackers impossible, but it makes brute force much, much less effective. If I have two million unsalted passwords, I just need to compute a hash for a dictionary word one time and then do two million string comparisons. If I have two million salted passwords, then I need to hash the dictionary word two million times. That is far, far more time consuming.

    3. Re:Do not use standard passwords by RenderSeven · · Score: 5, Funny

      What an excellent opportunity! I just told everybody on my LinkedIn account what I *really* thought of them, waited an hour, and told them all my password was hacked. Good times, good times.

  2. gpg by Anonymous Coward · · Score: 5, Interesting

    gpg - --gen-rand 1 9 | gpg -cat > linkedin.asc

    And presto, 72 bits of sweet entropy in your password which you don't even need to remember. It suffices to remember ONE password.
    Need your linkedin password?
    gpg linkedin.asc | xsel
    (and type your one password).

    Note that this way your linkedin password is never typed and never shows up on the screen.

  3. Re:Value of a linkedin account by Anonymous Coward · · Score: 5, Insightful

    It probably has little value, but the account name is an email address. Many people use the same account/pass combination for multiple sites, including perchance their paypal account. If they manage to pull a few million email/password combos from linkedin, I can guarantee you that some of those combinations will match paypal exactly.

  4. slashdot by rapiddescent · · Score: 5, Funny

    own up, who used the password slashdot - 0000003627a75d6c96a3d965247584a78779bc3d

  5. Re:Check your password by Jahava · · Score: 5, Informative

    www.leakedin.org/

    Nobody should use this site, period.

    You seriously expect people to go to an arbitrary site and enter their password, knowing that the hashes have been leaked alongside account information?

    In the kindest possible world this may be seen as a service, but the skeptic in everyone should hear very loud alarm bells. This site could easily log all of the passwords that are entered for "testing", use them to solve the harder-to-brute-force hashes, and deliver to the site operator the resulting account information and plaintext password!

    Even if you had the best intentions posting that link, and even if the site actually is completely innocuous, one should never encourage any user to enter their password into a random third-party site. Please take it down immediately.