3 ms·

Hmm it isn't complete; My password isn't on there yet. =\

by meric 15y ago

thaumaturgy 15y ago
Well, considering that 292 of the passwords contain mixed case, 79 of them are 12 characters or more (this one's nice: "qwe123QWE!@#"), 59 of them contain non-alphanumeric characters, and 6713 of the 8655 passwords posted are unique ... it's probably only a matter of time. Nice. I think it's time to upgrade all my passwords.
- doublec 15y ago
  "qwe123QWE!@#" is only nice until you look at the keyboard. First three qwerty letters. First three keys just above them. Then the same shifted.
  - thaumaturgy 15y ago
    Yeah, I caught that but it's still decent at meeting the usual password requirements, and it's almost as arbitrary as any other keyboard pattern.
  - silencio 15y ago
    I was surprised at how few randomly generated passwords there were in that list, if any. Like you mention, there's a lot of variants on qwerty/12345/!@#$%: 1qaz2wsx, Zaq1Xsw2, 1qazxsw23e, 1q2w3e, !@#$1234, etc. "ZXasqw12!@" was about as random as it got from a quick scroll-through, and even that is basically just keys directly next to each other. I assume randomness doesn't mean as much as sheer password length does when it comes to crackability, but I wonder if there's anything to be learned from this. Maybe only that random password generators tend to default to a safer (longer) length? :)
    - DarkShikari 15y ago
      Random passwords are probably not going to be cracked by a run-through of John with a ruleset, which is likely similar to -- or exactly -- what was used to create this list. These are salted FreeBSD MD5s (iterated hash); even with a powerful GPU, you're probably only going to be able to check a few hundred thousand per second at best.
- brs 15y ago
  For what it's worth, my password was 8 random alphanumerics, and it's not in the list, while /.,mnbvcxz (12 alphanumerics with symbols) is there. The cracker must have some sort of algorithm that looks for consecutive patterns on the keyboard. It goes to show that the old rules - non-dictionary word, mixed case, etc - really don't cut it anymore. Psychologically, picking a password that has high entropy is quite difficult, and the crackers are only going to develop better algorithms in the future. I think using a good random generator is the only way to ensure you have a decent password these days.
  - devinlane 15y ago
    I dunno, they managed to crack "G7io5639*%V64ioT5h9" -- 19 characters including lowercase, uppercase, numbers, and symbols. It doesn't seem to follow any pattern on a QWERTY layout -- maybe another layout? I wasn't aware they could crack passwords that long though -- wasn't that supposed to take years, even with a GPU?
shawndumas 15y ago
Nor mine.
- Jach 15y ago
  Nor mine. Of course mine was only 8 characters, character set of size 72, so only a "mere" 722,204,136,308,736 possible permutations. In any case the couple places that one was reused have been updated already, I'm still waiting for it to show up eventually.
- kayoone 15y ago
  nor mine, and it wasnt particularly secure either
rakkhi 15y ago
Yeah mine niether. I have confidence it won't end up there either. The way the difficulty and time hockeysticks up once you hit the low hanging fruit is amazing(<8 char, non complex, simple patterns and common passwords, dictionary words and number / symbol variants). http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-reasons-i.html http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-...

Hmm it isn't complete; My password isn't on there yet. =\

by meric 15y ago

Hmm it isn't complete; My password isn't on there yet. =\

Well, considering that 292 of the passwords contain mixed case, 79 of them are 12 characters or more (this one's nice: "qwe123QWE!@#"), 59 of them contain non-alphanumeric characters, and 6713 of the 8655 passwords posted are unique ... it's probably only a matter of time. Nice. I think it's time to upgrade all my passwords.

doublec 15y ago
"qwe123QWE!@#" is only nice until you look at the keyboard. First three qwerty letters. First three keys just above them. Then the same shifted.
- thaumaturgy 15y ago
  Yeah, I caught that but it's still decent at meeting the usual password requirements, and it's almost as arbitrary as any other keyboard pattern.
- silencio 15y ago
  I was surprised at how few randomly generated passwords there were in that list, if any. Like you mention, there's a lot of variants on qwerty/12345/!@#$%: 1qaz2wsx, Zaq1Xsw2, 1qazxsw23e, 1q2w3e, !@#$1234, etc. "ZXasqw12!@" was about as random as it got from a quick scroll-through, and even that is basically just keys directly next to each other. I assume randomness doesn't mean as much as sheer password length does when it comes to crackability, but I wonder if there's anything to be learned from this. Maybe only that random password generators tend to default to a safer (longer) length? :)
  - DarkShikari 15y ago
    Random passwords are probably not going to be cracked by a run-through of John with a ruleset, which is likely similar to -- or exactly -- what was used to create this list. These are salted FreeBSD MD5s (iterated hash); even with a powerful GPU, you're probably only going to be able to check a few hundred thousand per second at best.
brs 15y ago
For what it's worth, my password was 8 random alphanumerics, and it's not in the list, while /.,mnbvcxz (12 alphanumerics with symbols) is there. The cracker must have some sort of algorithm that looks for consecutive patterns on the keyboard. It goes to show that the old rules - non-dictionary word, mixed case, etc - really don't cut it anymore. Psychologically, picking a password that has high entropy is quite difficult, and the crackers are only going to develop better algorithms in the future. I think using a good random generator is the only way to ensure you have a decent password these days.
- devinlane 15y ago
  I dunno, they managed to crack "G7io5639*%V64ioT5h9" -- 19 characters including lowercase, uppercase, numbers, and symbols. It doesn't seem to follow any pattern on a QWERTY layout -- maybe another layout? I wasn't aware they could crack passwords that long though -- wasn't that supposed to take years, even with a GPU?

shawndumas 15y ago

Nor mine.

Jach 15y ago
Nor mine. Of course mine was only 8 characters, character set of size 72, so only a "mere" 722,204,136,308,736 possible permutations. In any case the couple places that one was reused have been updated already, I'm still waiting for it to show up eventually.
kayoone 15y ago
nor mine, and it wasnt particularly secure either

rakkhi 15y ago

Yeah mine niether. I have confidence it won't end up there either. The way the difficulty and time hockeysticks up once you hit the low hanging fruit is amazing(<8 char, non complex, simple patterns and common passwords, dictionary words and number / symbol variants). http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-reasons-i.html http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-...