5 ms·
I wonder about the 2580s (vertical numbers on a PIN pad). It makes perfect sense for PINs, but not a computer keyboard. It could be people keeping their passwor
by rm999 14y ago
I wonder about the 2580s (vertical numbers on a PIN pad). It makes perfect sense for PINs, but not a computer keyboard. It could be people keeping their passwords consistent with their PINs e.g. using their ATM PIN for their online bank account password.
A lot sites (correctly) prevent people from using very short or simple passwords, including four digit numbers. I'm curious what sites his database comes from.
- maxerickson 14y agoThis paper(PDF) uses the RockYou password database to do a similar analysis: http://www.cl.cam.ac.uk/~jcb82/doc/BPA12-FC-banking_pin_security.pdf http://www.cl.cam.ac.uk/~jcb82/doc/BPA12-FC-banking_pin_secu... (RockYou discussed here: http://en.wikipedia.org/wiki/RockYou#Controversy http://en.wikipedia.org/wiki/RockYou#Controversy ) The patterns displayed by the codes in the paper are similar to the blog.
- rm999 14y agoWow, it's worse than I thought. Rockyou doesn't allow 4 character passwords so they were extracting the numbers from WITHIN longer passwords. 'asdf1975' would equate to a 'pin' of 1975, or 37489 would equate to two pins, 3748 and 7489. What a terrible assumption to build all your research on top of.
- maxerickson 14y agoThe paper is quite clear about the methodology used, they only extracted exact 4 digit sequences. I repeated that much of the analysis, I wanted to examine the patterns, not just look at the frequency plot. I got the same ~1.7 million sequences using a regex that excluded 5 digit sequences. The blog is less clear.