4 ms·
What's wrong with 3 and 4? It appears that, in general, the FBI staff are setting reasonable passwords. There are a few passwordNNN types but the majority are
by brador 14y ago
What's wrong with 3 and 4?
It appears that, in general, the FBI staff are setting reasonable passwords. There are a few passwordNNN types but the majority are adequate and, in my opinion, would hold up well against a brute force vector, which is the primary purpose of password complexity.
- simias 14y agoThe fact that some of those passwords appear very strong also means they weren't bruteforced and therefore most likely stored in plaintext. I guess even the FBI have sloppy programmers...
- espadrine 14y agoThey say on the pastebin that one connexion sent passwords in clear text (through asipx-webadmin), so they probably were read there. At least it was probably an entry point.
- vibrunazo 14y ago3 and 4 would not take long to be brute forced by a dictionary attack, I think. Too many people use qwerty on their password, so it's probably high rated on a dictionary attack.
- nikic 14y ago3 and 4 are weak because we have pretty good heuristics on how passwords are composed so it wouldn't take much longer to brute-force them than it would to do password123.
- DanBC 14y agoI'd be interested to see if either 3 or 4 appear on existing password dictionaries.