The distribution of 1-digit numbers is simple: when sites require a digit, everybody appends '1' to their usual password. The exponential declining frequency of subsequent digits is because when passwords 'expire' folks just add 1. The short lifetime of site usage results in that decline. Just thinking out loud.
Analyzing the Patterns of Numbers in 10M Passwords (2015)
11–20 of 41 posts
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#12Looks like a few of the patterns in his analysis has a tendency towards Benford's Law[1] [1]: https://en.wikipedia.org/wiki/Benford%27s_law
Technically it describes none of these. Benford's Law only describes collections of leading digits. The charts in the article are just exponential distributions.
Yeah. Reading a bit more into it, I think you're right.
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#13Huh. Of all my old blog posts, this is the last one I expected to randomly resurface at the top of Hacker News. There were a lot of other articles made using this 10M Password dataset at the time it was originally released, which the dataset author aggregated into a subreddit ( https://www.reddit.com/r/10millionpasswords/ ). WPEngine, for example, has a much more comprehensive writeup with ad-hoc looks at specific pa…
Off topic, but where do you host your website and what is your tech stack?
Would it be possible to do a blog post about traffic patterns from HN? Eg- Hits vs time since post, hits vs day of post.
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#14Notable fact: '69' makes it as '3rd most used combination of 2 numbers in passwords'.
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#15I think brute force password crackers could be made much more efficient by using machine learning or manually written rules to exploit how people choose passwords.
Even if you force users to pick a password of at least 8 characters with upper and lower case letter, numbers and special characters, I suspect the real entropy is much lower than the theoretical.
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#16Notable fact: '69' makes it as '3rd most used combination of 2 numbers in passwords'.
I assume because most users were born in 1969?
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#17Huh. Of all my old blog posts, this is the last one I expected to randomly resurface at the top of Hacker News. There were a lot of other articles made using this 10M Password dataset at the time it was originally released, which the dataset author aggregated into a subreddit ( https://www.reddit.com/r/10millionpasswords/ ). WPEngine, for example, has a much more comprehensive writeup with ad-hoc looks at specific pa…
Off topic, but where do you host your website and what is your tech stack? Would it be possible to do a blog post about traffic patterns from HN? Eg- Hits vs time since post, hits vs day of post.
The site is static, hosted on GitHub Pages and generated via Jekyll, backed by Cloudflare for extra HN-proofing.
As of this comment, there are 150-170 concurrent users on the site, with about 120 of them (~80%) from HN. Although I do have the data, I am hesitant to do a write up since I would need to correlate traffic to the rank of a submission on HN, which I do not have in retrospect. (For example, a post at #1 can get 300 concurrent users while this post at #3 only 150. Posts in #20-30 are lucky to get 50 concurrents. For further reference, note that Reddit posts which hit the front page of a default like /r/dataisbeautiful can get 1,000 concurrents.)
EDIT: When this post dropped to #4, traffic immediately dropped to 100-110 concurrents.
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#18Notable fact: '69' makes it as '3rd most used combination of 2 numbers in passwords'.
I assume because most users were born in 1969?
I'm not sure if this comment is deeply sarcastic and insightful on a number of topics, or just hopelessly naive. I'm learning towards sarcastic and insightful, and it's impressive.
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#19I think brute force password crackers could be made much more efficient by using machine learning or manually written rules to exploit how people choose passwords. Even if you force users to pick a password of at least 8 characters with upper and lower case letter, numbers and special characters, I suspect the real entropy is much lower than the theoretical.
That had been done for more than a decade now.
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#20I think brute force password crackers could be made much more efficient by using machine learning or manually written rules to exploit how people choose passwords. Even if you force users to pick a password of at least 8 characters with upper and lower case letter, numbers and special characters, I suspect the real entropy is much lower than the theoretical.
There were a couple of talks about this at password^12:
Like:
http://passwords12.at.ifi.uio.no/Kirsi_Helkala/
http://passwords12.at.ifi.uio.no/Markus_Duermuth_Password_Se...
But it's a whole conference about passwords... so not sure if I found the presentation I had in mind...:
http://passwords12.at.ifi.uio.no/
And btw, registration is now open for password^16 in Germany in December: https://passwordscon.org/