slightly off topic, what tool/lib did you use to make the charts?"
I am not the author but I imagine this was not included as a joke: "All charts were made using R and ggplot2."
Analyzing the Patterns of Numbers in 10M Passwords (2015)
31–40 of 41 posts
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#32slightly off topic, what tool/lib did you use to make the charts?"
All charts in this post were made using R/ggplot2. (The code was not open sourced in this case because the code for this post is a mess. I have revised my process since)
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#33Reminds me about the tidbit about "strong password" rules, like one each of small letter, capital letter, digit or symbol. Like: "Password2016". Really strong. It's even longer than 8 letters.
"E12e likes 2016" is probably even stronger and easier to remember
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#34There's a comment there [0] asking for more graphs including the distribution for password managers that randomly generate passwords... erm... [0]: http://minimaxir.com/2015/02/password-numbers/#comment-18765...
Looks like this guy is doing some serious campaigning for his password manager, take a look at his previous comments:
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#35The problem with this type of analysis is that it treats the 10million passwords as if they are representative of all passwords. A more descriptive title would be: "Analyzing the Patterns of Numbers in 10 Million passwords that were not randomly selected from an unknown number of accounts" One of the first cracking rules in john is append a "1" to dictionary word. "123" is one of the few multidigit strings that john…
the first cracking
rules in john
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#36Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#37Earlier quoted context omitted.
Off topic, but where do you host your website and what is your tech stack? Would it be possible to do a blog post about traffic patterns from HN? Eg- Hits vs time since post, hits vs day of post.
The site is static, hosted on GitHub Pages and generated via Jekyll, backed by Cloudflare for extra HN-proofing. As of this comment, there are 150-170 concurrent users on the site, with about 120 of them (~80%) from HN. Although I do have the data, I am hesitant to do a write up since I would need to correlate traffic to the rank of a submission on HN, which I do not have in retrospect. (For example, a post at #1 can…
Man, you have to do a post about traffic patterns to your website with whatever data you have, it's way too interesting. Leave out the rank correlation part, and share whatever data you have available. Please!
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#38Huh. Of all my old blog posts, this is the last one I expected to randomly resurface at the top of Hacker News. There were a lot of other articles made using this 10M Password dataset at the time it was originally released, which the dataset author aggregated into a subreddit ( https://www.reddit.com/r/10millionpasswords/ ). WPEngine, for example, has a much more comprehensive writeup with ad-hoc looks at specific pa…
Out of curiosity (and because I'd love to read more), which of your old blog posts would you MOST expect to randomly resurface at the top of HN?
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#39I think brute force password crackers could be made much more efficient by using machine learning or manually written rules to exploit how people choose passwords. Even if you force users to pick a password of at least 8 characters with upper and lower case letter, numbers and special characters, I suspect the real entropy is much lower than the theoretical.
Some of the latest research on this technique:
Fast, Lean, and Accurate: Modeling Password Guessability Using Neural Networks https://www.ece.cmu.edu/~lbauer/papers/2016/usenixsec2016-ne...
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#40Huh. Of all my old blog posts, this is the last one I expected to randomly resurface at the top of Hacker News. There were a lot of other articles made using this 10M Password dataset at the time it was originally released, which the dataset author aggregated into a subreddit ( https://www.reddit.com/r/10millionpasswords/ ). WPEngine, for example, has a much more comprehensive writeup with ad-hoc looks at specific pa…
Out of curiosity (and because I'd love to read more), which of your old blog posts would you MOST expect to randomly resurface at the top of HN?
My 2013 post "Which Universities Produce the Most Successful Startup Founders?" is one of my posts which received the most notority at the time: http://minimaxir.com/2013/07/alma-mater-data/
However, there are a number of data fidelity issues which would get me teared apart in the HN comments nowadays.