Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

300M Freely Downloadable Pwned Passwords

troyhunt.com

Post reply on HN
Print view View original

181–184 of 184 posts

Re: 300M Freely Downloadable Pwned Passwords

#181

Post by Deimorz »

royce wrote: post #177
Deimorz wrote: post #117

One really unfortunate aspect of the passwords being hashed is that there's no info available about their lengths. Knowing the lengths could allow you to reduce the size considerably when you enforce a minimum password length. For example, if I have a site that requires passwords to be at least 10 chars long, I don't need any of the data for breached passwords that are shorter than 10 characters. People can't possibl…

I've cracked* just under 99% of them so far (including the 14 million added in Update 1). Statistics are here: https://gist.github.com/roycewilliams/b1de2afbfe5cb71bea16c9... Regardless of composition, the top 12 lengths are: 8: 32% (102260862) 10: 14% (45084047) 9: 13% (41525797) 7: 10% (33632055) 6: 06% (20211176) 11: 05% (18275968) 12: 04% (14052958) 15: 02% (8291459) 13: 02% (8042452) 14: 01% (6321198) 16: 01% (4…

Oh, very cool, thanks for posting. I had actually written a really basic cracker and started seeing if I could figure out how many of them belonged to shorter passwords, but you're doing a much, much better job of it than I am (I was just brute-force generating short passwords, no wordlists or anything).

Are you planning to make a blog post or anything "final" with the info you find out, or will you just keep updating those gists?

Re: 300M Freely Downloadable Pwned Passwords

#182

Post by royce »

Deimorz wrote: post #181
royce wrote: post #177

Earlier quoted context omitted.

I've cracked* just under 99% of them so far (including the 14 million added in Update 1). Statistics are here: https://gist.github.com/roycewilliams/b1de2afbfe5cb71bea16c9... Regardless of composition, the top 12 lengths are: 8: 32% (102260862) 10: 14% (45084047) 9: 13% (41525797) 7: 10% (33632055) 6: 06% (20211176) 11: 05% (18275968) 12: 04% (14052958) 15: 02% (8291459) 13: 02% (8042452) 14: 01% (6321198) 16: 01% (4…

Oh, very cool, thanks for posting. I had actually written a really basic cracker and started seeing if I could figure out how many of them belonged to shorter passwords, but you're doing a much, much better job of it than I am (I was just brute-force generating short passwords, no wordlists or anything). Are you planning to make a blog post or anything "final" with the info you find out, or will you just keep updatin…

You're welcome! And "¿por que no los dos?" :) I'll keep the gists updated and will also do a blog post, I think.

With a tool like hashcat, a modern GPU or two, and some publicly available wordlists, you can get the vast majority of them without breaking a sweat.

In other words: there is almost no value in hashing them with SHA1.

Re: 300M Freely Downloadable Pwned Passwords

#183

Post by AlexCoventry »

rrauenza wrote: post #176
AlexCoventry wrote: post #137

Earlier quoted context omitted.

sha1sum is giving different results. /tmp$ echo "p@55w0rd" | sha1sum 8633c4a8b38a8826132414d8861af7b6a8371976 - This is a different value from the one given in the blog post: "ce0b2b771f7d468c0141918daea704e0e5ad45db". The python sha-1 hexdigest comes out right, though: In [13]: import sha In [14]: sha.new('p@55w0rd').hexdigest() Out[14]: 'ce0b2b771f7d468c0141918daea704e0e5ad45db' In case anyone else has passwords th…

Make sure you clean your .history if you're using echo to pipe the password...

Thanks. I had done so.
Post reply on HN