5 ms·

Interestingly, many of the longest passwords follow the same principle: A sentence repeated three times with two scrambled letters in one word each.

by elaus 10y ago

germanier 10y ago
That might be an artefact of how they were found. Note that the page says "a few of the longer passwords". It's likely that they specifically searched for passwords using that principle.
deleted 10y ago
[deleted]
INTPenis 10y ago
Sentences usually have whitespaces between words though, makes the passwords much easier to remember and handle. I'm assuming last.fm does not support blanks in their passwords since none of these passwords use that character. Or perhaps very few people realize you can use that character to help make passwords more manageable. My recommendation to people who ask the past few years has been full, grammatically correct sentences.
- foliveira 10y ago
  They do support spaces. There's one password with 39chars down the list (about an "unveiling")
- Jugurtha 10y ago
  The problem is that the vast majority of websites I've seen handle the whole process involving passwords horribly (registration, resetting, etc), which induces users to use bad passwords just to get it over with. Some let you fill out the form and then click on submit and tell you a problem with your password or something. You change it, then they tell you it has to be shorter than 15 or 10 characters, and impose such conditions you almost wait for them to tell you "use: 2Hx,!rJ" as your password. Some don't even support "special" characters, spaces, or hyphens. By the 4th or 5th attempt to register, you're basically trying to come up with the stupidest password you can to feed this monstrosity. Mind you, somme of these are big companies websites. I think password or registration management also affects things like talent acquisition. Companies using Taleo for instance are doing a great job of repulsing normal, mentally sane, people. The whole approach of registering one account for each company on a different company subdomain on the same domain (company1.taleo.net, company2.taleo.net) and for each one fill out the profile all over again is beyond the realm of my comprehension. The browser asks you to save the password/username for the website, but it does so for the domain, not the subdomains which all have different passwords. I give up on a company if it's using Taleo. I'm not talented or competent, but I'm sure really competent people wouldn't want to put up with this either and it hurts recruiting.
  - ryandrake 10y ago
    >The browser asks you to save the password/username for the website, but it does so for the domain, not the subdomains which all have different passwords. I give up on a company if it's using Taleo. I'm not talented or competent, but I'm sure really competent people wouldn't want to put up with this either and it hurts recruiting. This sounds like your browser's password manager's problem, namely assuming that users will only have a single password per top-level domain.
kazinator 10y ago
Disturbingly, many do not, like the very first and longest one. Of course, that one was gotten because it's simply the title of a song, mapped to lower case with spaces removed. Password phrases, even if long sentences, must not be something pulled from popular culture. I wouldn't expect, say, "thequickbrownfoxjumpedoverthelazydogs" to hold up. I bet you that it woudn't have been cracked, had the user had changed a few words in a way that is easy to memorize. I would have changed "stripper is crying" to "stripper is dichloromethane". (Compound used as powerful paint stripper.)

Interestingly, many of the longest passwords follow the same principle: A sentence repeated three times with two scrambled letters in one word each.

by elaus 10y ago

Interestingly, many of the longest passwords follow the same principle: A sentence repeated three times with two scrambled letters in one word each.

germanier 10y ago

That might be an artefact of how they were found. Note that the page says "a few of the longer passwords". It's likely that they specifically searched for passwords using that principle.

deleted 10y ago

[deleted]

INTPenis 10y ago

Sentences usually have whitespaces between words though, makes the passwords much easier to remember and handle. I'm assuming last.fm does not support blanks in their passwords since none of these passwords use that character. Or perhaps very few people realize you can use that character to help make passwords more manageable. My recommendation to people who ask the past few years has been full, grammatically correct sentences.

foliveira 10y ago
They do support spaces. There's one password with 39chars down the list (about an "unveiling")
Jugurtha 10y ago
The problem is that the vast majority of websites I've seen handle the whole process involving passwords horribly (registration, resetting, etc), which induces users to use bad passwords just to get it over with. Some let you fill out the form and then click on submit and tell you a problem with your password or something. You change it, then they tell you it has to be shorter than 15 or 10 characters, and impose such conditions you almost wait for them to tell you "use: 2Hx,!rJ" as your password. Some don't even support "special" characters, spaces, or hyphens. By the 4th or 5th attempt to register, you're basically trying to come up with the stupidest password you can to feed this monstrosity. Mind you, somme of these are big companies websites. I think password or registration management also affects things like talent acquisition. Companies using Taleo for instance are doing a great job of repulsing normal, mentally sane, people. The whole approach of registering one account for each company on a different company subdomain on the same domain (company1.taleo.net, company2.taleo.net) and for each one fill out the profile all over again is beyond the realm of my comprehension. The browser asks you to save the password/username for the website, but it does so for the domain, not the subdomains which all have different passwords. I give up on a company if it's using Taleo. I'm not talented or competent, but I'm sure really competent people wouldn't want to put up with this either and it hurts recruiting.
- ryandrake 10y ago
  >The browser asks you to save the password/username for the website, but it does so for the domain, not the subdomains which all have different passwords. I give up on a company if it's using Taleo. I'm not talented or competent, but I'm sure really competent people wouldn't want to put up with this either and it hurts recruiting. This sounds like your browser's password manager's problem, namely assuming that users will only have a single password per top-level domain.

kazinator 10y ago

Disturbingly, many do not, like the very first and longest one. Of course, that one was gotten because it's simply the title of a song, mapped to lower case with spaces removed. Password phrases, even if long sentences, must not be something pulled from popular culture. I wouldn't expect, say, "thequickbrownfoxjumpedoverthelazydogs" to hold up. I bet you that it woudn't have been cracked, had the user had changed a few words in a way that is easy to memorize. I would have changed "stripper is crying" to "stripper is dichloromethane". (Compound used as powerful paint stripper.)