Hacker News Reader

Comment by 16s | Hacker News Reader

Linkedin allowed 6 character passwords. If a user selected six random uppercase ASCII, lowercase ASCII and numbers, this would be the bit-strength:

print math.log(62) / math.log(2) * 6

35.72 bits

That's easy to crack. Also, keep in mind that humans don't select chars randomly. So the bit-strength of these passwords was probably closer to 20 bits. I cracked 2.5 million with an old cpu and JtR within a few hours.

View on HN

This is the advice I give to my family members. The solution is to create a one-time-pad in excel(!) that contains all of your passwords. Store it on an encrypted thumb drive and carry it with your keys. There is the possiblity that your OTP may contain a character set that is not congruent with a web-service's password system, but these circumstances are rare.

Just use keepass. If you're already carrying around a password file, you can carry around portable binaries of the program that reads your passwords.

www.keepass.info

sadly, Keepass is not very Mac/Linux friendly, because it's built on .NET, so it's only an option for pure Windows users.

I use Keepass daily on Windows and Ubuntu and used it on OS X in the past without any issues. I highly recommend it.

I don't know about Linux, but I've been using KeePassX for Mac for about a year now. It only supports the older KeePass file format, and it's ugly, but it works great. There are also a few iOS apps you can use, my favorite of which is KyPass.

Reply on news.ycombinator.com