4 ms·
Millions of stolen Last.fm passwords have been decrypted. These are the top 50
- tomp 10y agoI wonder how much passwords like "lastfm", "music" and "abcdefg123" are an indication of people just being bad with security, as opposed to people just not giving a damn... Amid the overflow of trivial sites requiring more and more login details, is there really a value in having strong passwords? Personally, I mostly don't care; I have strong passwords for important sites (banks, online stores that have my credit card details), but for the rest of logins, I use pretty trivial passwords - if someone "steals" my account, I'll just create another one!
- paulddraper 10y agoBut what if they post snarky comments as you on HN?
- antoineMoPa 10y agoHN is an important site I guess.
- totony 10y agoThat would be disastrous.
- SNvD7vEJ 10y agona, no problem. 'tomp2' is still available
- tomp 10y agoI'll just link back to this comment and claim my account was hacked...
- LeoPanthera 10y agoBut you are the exception. The problem is not really weak passwords, it's re-used passwords. A lot of people just use one password and they use it everywhere, so as soon as it gets cracked once, their accounts can be compromised all over the place. The best thing I ever did for my parents was teach them to use different passwords everywhere. Against conventional wisdom, I get them to write them down in a book, because for them, keeping a book secure is much easier than knowing what to do to keep their computers secure. We already know how to keep physical objects reasonably secure, we do it every day with our credit cards, passports, jewelry etc.
- JoshTriplett 10y agoExactly. When a random site demands that you create an account to continue, you might create a throw-away account that you don't expect to reuse. Worse yet, some such sites intentionally break pasting into the password field, making it a pain to paste in a randomly generated password.
- LeoPanthera 10y ago> some such sites intentionally break pasting into the password field You can fix that with a bookmarklet to re-enable pasting. var inputs = document.getElementsByTagName('input'); for (var i=0; i < inputs.length; i++) { if (inputs[i].getAttribute('type').toLowerCase() === 'password') { inputs[i].setAttribute('onpaste', ''); } } (Tested with desktop Safari, no idea about other browsers.)
- Myrmornis 10y agoExactly. Part of the annoyance of passwords is due to the loss of perspective that comes with running a business, SAAS offering etc: you, the owner, may think it's a big deal, but if there are no credit cards involved, the databases of most websites don't contain anything the users really care about. In fact the most sensitive thing they probably hold is the password / hash thereof, because they force people (inappropriately) to use strong and therefore valuable passwords.
- KayL 10y agoYes. I do the same way. I have few set of password and used for different type of sites
- pseudointellect 10y agoHow does Last.fm allow "0" to be a password? You'll always have people who will tend to pick poor passwords, but shouldn't the service try to at least have some decent password standards?
- thenewwazoo 10y agoI do hobby research into password guessing entropy and I'd love to get ahold of these lists of in-the-wild passwords. Is there any good source for such things? I don't need usernames, just "real" passwords (with frequency data if I can get it).
- LeoPanthera 10y agohttp://academictorrents.com/details/fd62cc1d79f595cbe1de6356fb13c2165994e469 http://academictorrents.com/details/fd62cc1d79f595cbe1de6356...
- thenewwazoo 10y agoWhoa! This is a great link and thank you but thank you even more for making me aware of academictorrents.com. I may never see the sunlight again.
- connoredel 10y agoI feel like this is misleading without the % share of the total. These top 50 represent 2.7% of the total. OK, that sounds bad, but I'm not really sure how to interpret it. Even if we get better at this, the top passwords will still be these, they'll just be lower as a % of the total. So until we have 100% unique passwords, this story will always be there, which just seems lazy.
- ancarda 10y agoIf you follow the link in the article to leakedsource.com, it says: Passwords were stored using unsalted MD5 hashing. It's 2016... why is this still happening?
- LeoPanthera 10y agoPresumably because last.fm was created in 2002 and they never changed it.
- onethumb 10y agoThis has been my go-to for passwords for awhile. Top 100, 500, 1000, etc all the way to millions. https://github.com/danielmiessler/SecLists/tree/master/Passwords https://github.com/danielmiessler/SecLists/tree/master/Passw...