3 ms·
Linkedin allowed 6 character passwords. If a user selected six random uppercase ASCII, lowercase ASCII and numbers, this would be the bit-strength: print math.
by 16s 14y ago
Linkedin allowed 6 character passwords. If a user selected six random uppercase ASCII, lowercase ASCII and numbers, this would be the bit-strength:
print math.log(62) / math.log(2) * 6
35.72 bits
That's easy to crack. Also, keep in mind that humans don't select chars randomly. So the bit-strength of these passwords was probably closer to 20 bits. I cracked 2.5 million with an old cpu and JtR within a few hours.
- 0003 14y agoThis is the advice I give to my family members. The solution is to create a one-time-pad in excel(!) that contains all of your passwords. Store it on an encrypted thumb drive and carry it with your keys. There is the possiblity that your OTP may contain a character set that is not congruent with a web-service's password system, but these circumstances are rare.
- saulrh 14y agoJust use keepass. If you're already carrying around a password file, you can carry around portable binaries of the program that reads your passwords. www.keepass.info
- LinXitoW 14y agosadly, Keepass is not very Mac/Linux friendly, because it's built on .NET, so it's only an option for pure Windows users.
- benholmen 14y agoI use Keepass daily on Windows and Ubuntu and used it on OS X in the past without any issues. I highly recommend it.
- dopo 14y agoI don't know about Linux, but I've been using KeePassX for Mac for about a year now. It only supports the older KeePass file format, and it's ugly, but it works great. There are also a few iOS apps you can use, my favorite of which is KyPass.