8 ms·

This list is immediately useful for validating user-created new passwords. Just stop with the bizarre rules about having uppercase, lowercase, symbols, numbers,

This list is immediately useful for validating user-created new passwords. Just stop with the bizarre rules about having uppercase, lowercase, symbols, numbers, length, etc. Instead require a string not in the top 10K (or 100K, or 1M) most popular.

bradleyjg 9y ago
Since the list is only rarely updated, this seems a perfect application Botelho's for minimal perfect hashing algorithm[1]. At about 8 bits per item storage and constant lookup it would be quite practical to use the top 32 Million list (appeared at least 10 times). [1] http://cmph.sourceforge.net/papers/tr06.pdf http://cmph.sourceforge.net/papers/tr06.pdf
- berzerk0 9y ago
  Speaking of rarely updated - version two will come out mid-July at the latest. I'm also going to attempt to attribute the sources to given countries or at least language families. The list as it stands has a heavily US-centric bias. I plan to grep through it and pull out things like Cyrillic or Arabic characters, and then repeat the process using only those characters. That's not to say that everyone who uses Arabic or Cyrillic characters is guaranteed to use them, but it's more specific. If "password" is #2 in the world, perhaps пароль (password) will be the #2 most popular password with Russian Cyrillic Characters
  - lucasgonze 9y ago
    I wonder about how to package your data as developer tools. There should be libraries in any language used to develop systems which validate user-entered passwords.
    - berzerk0 9y ago
      Dropbox has their zxcvbn method which incorporates a list of 30k of the most common passwords https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn
      - bradleyjg 9y ago
        It looks like they gzip the file over the wire and then work with it uncompressed. That's probably a reasonable choice given they use only 30,000 passwords.
microwavecamera 9y ago
"Your password must be between 12 to 46 characters long and must include at least one number, upper case character, special character, kanji character, rune and quadratic equation"
- Mz 9y ago
  "It also needs to be changed every 60 days and cannot be the same as one previously used in the past year." (Promptly changes around variables in quadratic equation for the umpteenth time, leaves the rest of the password the same.)
- dheera 9y ago
  I used to just tack on Aa$0 to the end of all my (already good) passwords to satisfy these idiotic rules. Until one website decided that '0' was not a number, and then I had to change everything to Aa$1.
  - Imagenuity 9y ago
    Until a website thinks a 1 is an lower case L, and you have the same problem all over again.
  - terminado 9y ago
    I tend to revolt against this kind of bullshit by creating terrifyingly primitive, pathetic passwords, and flagrantly sharing what my password is, in front of relevant admins, while complaining loudly about the concept of "character diversity," as a way of fomenting popular rebellion. When I'm met with periodic expiration, I employ constant direct password assistance as a means of unpopular two-factor authentication, to piss people off, and stir the pot. I then fail my password reset as many times as necessary to recover my preferred password for that system, to enforce to freedom of password selection. I control my password. Me. Not you. Me.
    - arcbyte 9y ago
      Im glad Im not the only one that does this.
expertentipp 9y ago
Note that this password list is valid rather for English speaking world.

bradleyjg 9y ago

Since the list is only rarely updated, this seems a perfect application Botelho's for minimal perfect hashing algorithm[1]. At about 8 bits per item storage and constant lookup it would be quite practical to use the top 32 Million list (appeared at least 10 times). [1] http://cmph.sourceforge.net/papers/tr06.pdf http://cmph.sourceforge.net/papers/tr06.pdf

berzerk0 9y ago
Speaking of rarely updated - version two will come out mid-July at the latest. I'm also going to attempt to attribute the sources to given countries or at least language families. The list as it stands has a heavily US-centric bias. I plan to grep through it and pull out things like Cyrillic or Arabic characters, and then repeat the process using only those characters. That's not to say that everyone who uses Arabic or Cyrillic characters is guaranteed to use them, but it's more specific. If "password" is #2 in the world, perhaps пароль (password) will be the #2 most popular password with Russian Cyrillic Characters
- lucasgonze 9y ago
  I wonder about how to package your data as developer tools. There should be libraries in any language used to develop systems which validate user-entered passwords.
  - berzerk0 9y ago
    Dropbox has their zxcvbn method which incorporates a list of 30k of the most common passwords https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn
    - bradleyjg 9y ago
      It looks like they gzip the file over the wire and then work with it uncompressed. That's probably a reasonable choice given they use only 30,000 passwords.

microwavecamera 9y ago

"Your password must be between 12 to 46 characters long and must include at least one number, upper case character, special character, kanji character, rune and quadratic equation"

Mz 9y ago
"It also needs to be changed every 60 days and cannot be the same as one previously used in the past year." (Promptly changes around variables in quadratic equation for the umpteenth time, leaves the rest of the password the same.)
dheera 9y ago
I used to just tack on Aa$0 to the end of all my (already good) passwords to satisfy these idiotic rules. Until one website decided that '0' was not a number, and then I had to change everything to Aa$1.
- Imagenuity 9y ago
  Until a website thinks a 1 is an lower case L, and you have the same problem all over again.
- terminado 9y ago
  I tend to revolt against this kind of bullshit by creating terrifyingly primitive, pathetic passwords, and flagrantly sharing what my password is, in front of relevant admins, while complaining loudly about the concept of "character diversity," as a way of fomenting popular rebellion. When I'm met with periodic expiration, I employ constant direct password assistance as a means of unpopular two-factor authentication, to piss people off, and stir the pot. I then fail my password reset as many times as necessary to recover my preferred password for that system, to enforce to freedom of password selection. I control my password. Me. Not you. Me.
  - arcbyte 9y ago
    Im glad Im not the only one that does this.

expertentipp 9y ago

Note that this password list is valid rather for English speaking world.