4 ms·
Also that's exactly what malicious actors would want to improve their dictionaries, to brute-force poorly-hashed dump from the next breach.
by ComodoHacker 10y ago
Also that's exactly what malicious actors would want to improve their dictionaries, to brute-force poorly-hashed dump from the next breach.
- NKCSS 10y agoThere are enough plain-text password lists for that, rockyou (old but good) and there are many more. Kali distro has some of them shipped if you are interested, and many more can be found online.
- thaumaturgy 10y agoThat's a tool they already have plenty of access to. I've tried to make a tool that will work against them, making it possible for any service, running any software stack, to efficiently blacklist hundreds of thousands of common passwords. I can (and should) start tracking down more password dumps and compiling them myself to do the same thing, but I've been spread pretty thin for a while. It's been on my mind but there hasn't been time for it. A massive list of plaintext passwords from Troy's dump, the ones that were available anyway, would have been really convenient. Odds are my index file would already be updated to a newer version.
- koolba 10y agoI thought all his data came from publicly available dumps. If so, it might make it easier to for them to have it all in one place, but it's not like he's giving them anything they can't get if they really wanted it (and probably have already).
- lorenzhs 10y agoNo, it also contains non-public dumps that someone gave to him (after authentication) iirc. But he never pays for dumps. I think he posted an explanation on his blog a while ago.