3 ms·
The problem with this type of analysis is that it treats the 10million passwords as if they are representative of all passwords. A more descriptive title would
by dfc 10y ago
The problem with this type of analysis is that it treats the 10million passwords as if they are representative of all passwords. A more descriptive title would be:
"Analyzing the Patterns of Numbers in 10 Million passwords that were not randomly selected from an unknown number of accounts"
One of the first cracking rules in john is append a "1" to dictionary word. "123" is one of the few multidigit strings that john appends in the default ruleset. Furthermore the first 5 million passwords were used to generate a character frequency database for cracking the second 5 million.
- minimaxir 10y agoThe 10M dump was collected from a wide variety of sources to avoid sampling bias.
- dfc 10y agoHow did you "avoid" sample bias? How many of the passwords come from databases that were dumped in cleartext or cracked with 100% success? Meaning every account on that system was included in cleartext or 100% of the passwords from a dump were cracked. The reason I ask is that the dataset you analyzed does not make this claim: "Now not all of these passwords are plaintext. Many dumps include passwords in a hashed format that requires you to crack them yourself." https://xato.net/a-glimpse-into-the-world-of-internet-password-dumps-5ee4609da237 https://xato.net/a-glimpse-into-the-world-of-internet-passwo...
- aWeighThrown 10y agothe first cracking rules in john And by John, you mean the "John The Ripper" program. https://en.wikipedia.org/wiki/John_the_Ripper https://en.wikipedia.org/wiki/John_the_Ripper