Agreed on both counts. It would be trivial to add a handful of common replacements like the ones mentioned during a dictionary attack.
I also find at least a little bit hilarious that Linkedin is lecturing us on security best practices. The main reason you need a strong password (assuming lock outs are in place) is because this kind of thing happens.
> The main reason you need a strong password (assuming lock outs are in place) is because this kind of thing happens.
I think it is just the opposite.
If you assume that password databases get compromised every now and then, then obviously you shouldn't reuse the same password everywhere. Even a strong password could become public if some badly implemented service stores it in plain text.
And if you don't reuse passwords, then they don't need to be strong (i.e. resilient to an off-line attack where billions of possibilities can be tested per second). There is no point in keeping that password safe if the associated service has already been hacked to the point of losing their password database. Therefore, a password that can withstand online guessing attacks is sufficient.
Most of my passwords are written down on a sheet of paper. Even if you knew that the sheet of paper contains some of my passwords, I don't think you'd be able to extract them since there's a layer of encryption between my eyes and my fingers.
Comments
Agreed on both counts. It would be trivial to add a handful of common replacements like the ones mentioned during a dictionary attack.
I also find at least a little bit hilarious that Linkedin is lecturing us on security best practices. The main reason you need a strong password (assuming lock outs are in place) is because this kind of thing happens.
> The main reason you need a strong password (assuming lock outs are in place) is because this kind of thing happens.
I think it is just the opposite.
If you assume that password databases get compromised every now and then, then obviously you shouldn't reuse the same password everywhere. Even a strong password could become public if some badly implemented service stores it in plain text.
And if you don't reuse passwords, then they don't need to be strong (i.e. resilient to an off-line attack where billions of possibilities can be tested per second). There is no point in keeping that password safe if the associated service has already been hacked to the point of losing their password database. Therefore, a password that can withstand online guessing attacks is sufficient.
Most of my passwords are written down on a sheet of paper. Even if you knew that the sheet of paper contains some of my passwords, I don't think you'd be able to extract them since there's a layer of encryption between my eyes and my fingers.
xkcd to the rescue once again - http://xkcd.com/538/