Substitute numbers for letters that look similar (for example, substitute “0″ for “o” or “3″ for “E”.
Am I correct in thinking that the amount of entropy added with cute tricks like this is essentially nil? Is this advice even remotely valid?
Never give your password to others or write it down.
I don't think the advice to never write your password down is very useful unless coupled with a better way to manage all of your passwords besides memorizing them (like a password manager).
Agreed on both counts. It would be trivial to add a handful of common replacements like the ones mentioned during a dictionary attack.
I also find at least a little bit hilarious that Linkedin is lecturing us on security best practices. The main reason you need a strong password (assuming lock outs are in place) is because this kind of thing happens.
> The main reason you need a strong password (assuming lock outs are in place) is because this kind of thing happens.
I think it is just the opposite.
If you assume that password databases get compromised every now and then, then obviously you shouldn't reuse the same password everywhere. Even a strong password could become public if some badly implemented service stores it in plain text.
And if you don't reuse passwords, then they don't need to be strong (i.e. resilient to an off-line attack where billions of possibilities can be tested per second). There is no point in keeping that password safe if the associated service has already been hacked to the point of losing their password database. Therefore, a password that can withstand online guessing attacks is sufficient.
Most of my passwords are written down on a sheet of paper. Even if you knew that the sheet of paper contains some of my passwords, I don't think you'd be able to extract them since there's a layer of encryption between my eyes and my fingers.
Online brute force is a non-issue, protecting from offline brute force is their responsibility (who cares how long and complex my password is if they store it in clear text). The only relevant advice for any online services is don’t use the same password for anything else and always log in via SSL.
Comments
Substitute numbers for letters that look similar (for example, substitute “0″ for “o” or “3″ for “E”.
Am I correct in thinking that the amount of entropy added with cute tricks like this is essentially nil? Is this advice even remotely valid?
Never give your password to others or write it down.
I don't think the advice to never write your password down is very useful unless coupled with a better way to manage all of your passwords besides memorizing them (like a password manager).
Agreed on both counts. It would be trivial to add a handful of common replacements like the ones mentioned during a dictionary attack.
I also find at least a little bit hilarious that Linkedin is lecturing us on security best practices. The main reason you need a strong password (assuming lock outs are in place) is because this kind of thing happens.
> The main reason you need a strong password (assuming lock outs are in place) is because this kind of thing happens.
I think it is just the opposite.
If you assume that password databases get compromised every now and then, then obviously you shouldn't reuse the same password everywhere. Even a strong password could become public if some badly implemented service stores it in plain text.
And if you don't reuse passwords, then they don't need to be strong (i.e. resilient to an off-line attack where billions of possibilities can be tested per second). There is no point in keeping that password safe if the associated service has already been hacked to the point of losing their password database. Therefore, a password that can withstand online guessing attacks is sufficient.
Most of my passwords are written down on a sheet of paper. Even if you knew that the sheet of paper contains some of my passwords, I don't think you'd be able to extract them since there's a layer of encryption between my eyes and my fingers.
xkcd to the rescue once again - http://xkcd.com/538/
There is a good XKCD comic that explains this: http://xkcd.com/936/
And if you check at http://crackedin.s3-website-us-east-1.amazonaws.com/ you will see nobody is using "correcthorsebatterystaple" !
All good brute-force crackers have such substitution rules builtin.
Online brute force is a non-issue, protecting from offline brute force is their responsibility (who cares how long and complex my password is if they store it in clear text). The only relevant advice for any online services is don’t use the same password for anything else and always log in via SSL.