<story><title>Lessons learned from cracking 2 million LinkedIn passwords</title><url>https://community.qualys.com/blogs/securitylabs/2012/06/08/lessons-learned-from-cracking-2-million-linkedin-passwords</url></story><parent_chain><item><author>runeks</author><text>Here&apos;s a useful one-liner to create a strong password in Linux:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    cat /usr/share/dict/words|egrep -v &quot;é|&apos;s$|[Åå]|[Øø]&quot;|shuf --random-source=/dev/random -n4
&lt;/code&gt;&lt;/pre&gt;
This uses the dictionary &lt;i&gt;/usr/share/dict/words&lt;/i&gt; and skips all the words containing characters like é, å, ø and all those ending in &lt;i&gt;&apos;s&lt;/i&gt;. The resulting word list has 72,940 words in it. Then it chooses 4 random words from this dictionary and prints them to the screen. This gives a password with about 65 bits of entropy.&lt;p&gt;By adding another word, thus creating a 5-word passphrase, a botnet capable of checking 1,000 trillion passwords per second would spend, on average, 1600 years cracking away before it would find the correct passphrase.&lt;p&gt;Here are some example 4-word passphrases produced using this method:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    poetically archaisms accept constrictors
    leukemia shuttlecocked checkout benevolently
    climactic gyrate dynamical predominates
    massage beef Concords recliners
&lt;/code&gt;&lt;/pre&gt;
These are surprisingly easy to remember. I use a 7-word passphrase for the most important things and it didn&apos;t take me more than a day or two to learn it.</text></item></parent_chain><comment><author>Periodic</author><text>The unix utility apg has some nice functions for generating passwords.  Particularly I like it&apos;s &quot;pronounceable&quot; algorithm which tries to generate passwords that are slightly pronounceable.  It&apos;s a good way to get those 6-14 character passwords with numbers, upper case, and punctuation that are easier to remember but still random.&lt;p&gt;&lt;pre&gt;&lt;code&gt;    WeampE6quaph (Weamp-E-SIX-quaph)
    2hoov2Klypfo (TWO-hoov-TWO-Klyp-fo)
    GicutOj8 (Gic-ut-Oj-EIGHT)
    HegEmWydwev5 (Heg-Em-Wyd-wev-FIVE)
    Tegdijetyik4 (Teg-dij-et-yik-FOUR)
    Fon7ochry (Fon-SEVEN-och-ry)
&lt;/code&gt;&lt;/pre&gt;
I usually take the password and type it about 100 times to see how it feels, subtly changing any characters that feel awkward to type.  This gives me a password that is very fast and natural to type (less likely to have errors), but still has a lot of randomness and obeys all the stupid password rules.</text></comment>
<story><title>Lessons learned from cracking 2 million LinkedIn passwords</title><url>https://community.qualys.com/blogs/securitylabs/2012/06/08/lessons-learned-from-cracking-2-million-linkedin-passwords</url></story><parent_chain><item><author>runeks</author><text>Here&apos;s a useful one-liner to create a strong password in Linux:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    cat /usr/share/dict/words|egrep -v &quot;é|&apos;s$|[Åå]|[Øø]&quot;|shuf --random-source=/dev/random -n4
&lt;/code&gt;&lt;/pre&gt;
This uses the dictionary &lt;i&gt;/usr/share/dict/words&lt;/i&gt; and skips all the words containing characters like é, å, ø and all those ending in &lt;i&gt;&apos;s&lt;/i&gt;. The resulting word list has 72,940 words in it. Then it chooses 4 random words from this dictionary and prints them to the screen. This gives a password with about 65 bits of entropy.&lt;p&gt;By adding another word, thus creating a 5-word passphrase, a botnet capable of checking 1,000 trillion passwords per second would spend, on average, 1600 years cracking away before it would find the correct passphrase.&lt;p&gt;Here are some example 4-word passphrases produced using this method:&lt;p&gt;&lt;pre&gt;&lt;code&gt;    poetically archaisms accept constrictors
    leukemia shuttlecocked checkout benevolently
    climactic gyrate dynamical predominates
    massage beef Concords recliners
&lt;/code&gt;&lt;/pre&gt;
These are surprisingly easy to remember. I use a 7-word passphrase for the most important things and it didn&apos;t take me more than a day or two to learn it.</text></item></parent_chain><comment><author>jackalope</author><text>That&apos;s only 4 tokens and you should assume at least some of the combinations are already in rainbow tables. I don&apos;t know how long it would take to create a rainbow table for the whole space, which is this big:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  72940^4 = 2.8304992 × 10^19
&lt;/code&gt;&lt;/pre&gt;
To put it in perspective, a 14-character password using &lt;i&gt;only&lt;/i&gt; lower case English alphabet letters as individual tokens already beats this:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  26^14 = 6.45099747 × 10^19&lt;/code&gt;&lt;/pre&gt;</text></comment>