4 ms·

Worth noting that these passwords are all MD5 encrypted but not salted. There were also no creation rules enforced, as a quick check reveals: Highest reused pa

by tansey 15y ago

Worth noting that these passwords are all MD5 encrypted but not salted. There were also no creation rules enforced, as a quick check reveals: Highest reused password count: 12023 "stratfor"? 12023 "password"? 517 "password1"? 46 "Password1"? 24 "123456"? 625 "12345678"? 74 "jesus"? 2 "love"? 7 "war"? 1 "michael"? 39 "america"? 7 "xbox360"? 0 "heroes"? 0 Those last 2 are popular for the battlefield heroes dataset and other gaming-related ones, so I keep them in my script as gaming sites are both highly targeted and usually poorly secured. Anyway, it's clear that no rules were enforced as a 3-letter dictionary word like "war" would never be allowed by any rule creation system. The fact that "stratfor" was used by nearly 1.4% of all accounts (!) tells me that either their users did not value these accounts or they simply have no idea how passwords are supposed to work.

mobileman 15y ago
Bad passwords really scare me.
majelix 15y ago
> users did not value these accounts Why would they value their password to one of 30ish different systems/websites?
gerhardi 15y ago
If the account does not hold any "vital" information, password "stratfor" could be quite a harmless password to leak, as I couldn't imagine anyone using that password for any other site/account. Although I don't know what user information is contained within the account. Anyway, it is stupid to use such passwords and it tells something about the persons using those. Maybe they would use site names as passwords on other sites also.
russellallen 15y ago
It was just a password to online news articles, not to my bank account...
- pavel_lishin 15y ago
  In your case, sure.
meriksson 15y ago
I've been a Stratfor subscriber on and off since they got started about 15 years ago (I was 14 years old at the time). The last time around I got a new subscription, Stratfor set a new password for me, and it was... "stratfor". This is just about the only bad thing I have to say about Stratfor. Being a long-time subscriber, I am always a few steps ahead of basically everyone else when it comes to global politics, and this has been very useful and enjoyable over the years. One thing worth pointing out is that a Stratfor account like mine does not contain any sensitive information. It gives me access to exactly the same Stratfor reports as any other subscriber. As far as I know, it would not be possible to obtain e.g. my credit card details by using that password.
steve8918 15y ago
How did you get a breakdown of all the passwords used? Did you try to crack them yourself, or has the cracked passwords been posted? I'm trying to figure out if my own password has been compromised.
- pavel_lishin 15y ago
  I assume that he just grepped for the md5 hash of the common passwords he tried. e.g., grep `md5 -s 'password' | cut -d ' ' -f 4` password_file | wc -l
- MadGouki 15y ago
  All you need to do to figure out the hash for a password is take the MD5 hash of it. My guess is the commenter you replied to just took some common passwords and some no-brainers and did a quick little "find all" for each hash. Here's a tool you can use to generate MD5 hashes for given passwords: http://www.iwebtool.com/md5?string=stratfor http://www.iwebtool.com/md5?string=stratfor Going from the hashes to the passwords requires brute forcing, dictionary attacks, that sort of thing.
- stouset 15y ago
  Assume it has.

by tansey 15y ago

mobileman 15y ago

Bad passwords really scare me.

majelix 15y ago

> users did not value these accounts Why would they value their password to one of 30ish different systems/websites?

gerhardi 15y ago

If the account does not hold any "vital" information, password "stratfor" could be quite a harmless password to leak, as I couldn't imagine anyone using that password for any other site/account. Although I don't know what user information is contained within the account. Anyway, it is stupid to use such passwords and it tells something about the persons using those. Maybe they would use site names as passwords on other sites also.

russellallen 15y ago

It was just a password to online news articles, not to my bank account...

pavel_lishin 15y ago
In your case, sure.

meriksson 15y ago

I've been a Stratfor subscriber on and off since they got started about 15 years ago (I was 14 years old at the time). The last time around I got a new subscription, Stratfor set a new password for me, and it was... "stratfor". This is just about the only bad thing I have to say about Stratfor. Being a long-time subscriber, I am always a few steps ahead of basically everyone else when it comes to global politics, and this has been very useful and enjoyable over the years. One thing worth pointing out is that a Stratfor account like mine does not contain any sensitive information. It gives me access to exactly the same Stratfor reports as any other subscriber. As far as I know, it would not be possible to obtain e.g. my credit card details by using that password.

steve8918 15y ago

How did you get a breakdown of all the passwords used? Did you try to crack them yourself, or has the cracked passwords been posted? I'm trying to figure out if my own password has been compromised.

pavel_lishin 15y ago
I assume that he just grepped for the md5 hash of the common passwords he tried. e.g., grep `md5 -s 'password' | cut -d ' ' -f 4` password_file | wc -l
MadGouki 15y ago
All you need to do to figure out the hash for a password is take the MD5 hash of it. My guess is the commenter you replied to just took some common passwords and some no-brainers and did a quick little "find all" for each hash. Here's a tool you can use to generate MD5 hashes for given passwords: http://www.iwebtool.com/md5?string=stratfor http://www.iwebtool.com/md5?string=stratfor Going from the hashes to the passwords requires brute forcing, dictionary attacks, that sort of thing.
stouset 15y ago
Assume it has.