The password “ji32k7au4a83” has been seen over a hundred times • Hacker News Board

Re: The password “ji32k7au4a83” has been seen over a hundred times

#41

Post by cheeze » Mon, Mar 04, 2019, 2:15 AM UTC

inopinatus wrote: post #26

shubhamjain wrote: post #8

Related story: For some weird reason, I memorized the serial key for a very popular software (I must be fifteen then). Even today, I can recite the 25-letter key without a hitch. And I have used its first ten letters as a password to one of my accounts. Guess what? The password has been used 4000+ times before [1]. It's hard to digest the fact that there are at least a thousand people in the world who did the same th…

Word of warning, if you use an ad/content blocker like uBlock Origin, and block 3rd-party JS, then HIBP may give up on its k-anonymity mechanism and just sends your password to their server in cleartext. Ensure you specifically permit loading jQuery from cloudflare.com, and check network traffic using a test password first.

Why does this happen?

It seems like a huge oversight to not detect ad blockers and let the user know that their password is being transmitted in plaintext if that's true...

Re: The password “ji32k7au4a83” has been seen over a hundred times

#42

Post by morpheuskafka » Mon, Mar 04, 2019, 2:16 AM UTC

inopinatus wrote: post #26

shubhamjain wrote: post #8

Related story: For some weird reason, I memorized the serial key for a very popular software (I must be fifteen then). Even today, I can recite the 25-letter key without a hitch. And I have used its first ten letters as a password to one of my accounts. Guess what? The password has been used 4000+ times before [1]. It's hard to digest the fact that there are at least a thousand people in the world who did the same th…

Word of warning, if you use an ad/content blocker like uBlock Origin, and block 3rd-party JS, then HIBP may give up on its k-anonymity mechanism and just sends your password to their server in cleartext. Ensure you specifically permit loading jQuery from cloudflare.com, and check network traffic using a test password first.

It's not cleartext if you're loading over HTTPS which is enforced on this site.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#43

Post by lvs » Mon, Mar 04, 2019, 2:17 AM UTC

ceocoder wrote: post #19

shubhamjain wrote: post #14

Earlier quoted context omitted.

Holy shit! Now that I have changed the password, can you please tell me how did you guess that?

Because bunch of us memorized fckgw rhqq2 yxrkt 8tg6w 2b7q8 for the very same reason back in early 2000s

Lol. Warez. It's been a long time.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#44

Post by mortenjorck » Mon, Mar 04, 2019, 2:17 AM UTC

giancarlostoro wrote: post #24

shubhamjain wrote: post #14

Earlier quoted context omitted.

Holy shit! Now that I have changed the password, can you please tell me how did you guess that?

https://www.urbandictionary.com/define.php?term=fckgw-rhqq2-...

I laughed out loud when I saw the sponsored domain registrar links down the page advertising “FCKGW-RHQQ2-YXRKT-8TG6W-2B7Q8.travel” and other TLDs.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#45

Post by xaduha » Mon, Mar 04, 2019, 2:18 AM UTC

shubhamjain wrote: post #8

Related story: For some weird reason, I memorized the serial key for a very popular software (I must be fifteen then). Even today, I can recite the 25-letter key without a hitch. And I have used its first ten letters as a password to one of my accounts. Guess what? The password has been used 4000+ times before [1]. It's hard to digest the fact that there are at least a thousand people in the world who did the same th…

> for a very popular software

You aren't fooling no one, might as well just say it.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#46

Post by cranej » Mon, Mar 04, 2019, 2:18 AM UTC

meruru wrote: post #29

Let this thread be a reminder for everyone to use a password manager.

Yeah IMO the only "good" passwords are those hard to remember even by yourself.

Personally most non-trivial passwords of mine were generated by 'pass'.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#47

Post by pishpash » Mon, Mar 04, 2019, 2:19 AM UTC

shubhamjain wrote: post #8

Related story: For some weird reason, I memorized the serial key for a very popular software (I must be fifteen then). Even today, I can recite the 25-letter key without a hitch. And I have used its first ten letters as a password to one of my accounts. Guess what? The password has been used 4000+ times before [1]. It's hard to digest the fact that there are at least a thousand people in the world who did the same th…

Never use a shared secret. Generate your own entropy.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#48

Post by pishpash » Mon, Mar 04, 2019, 2:20 AM UTC

davik wrote: post #5

acqq wrote: post #2

Searching a little (it's easy because it's unique) and then automatically translating 2014 article titled: "How to set up a safe and easy to remember password" reveals: http://www.netqna.com/2014/05/do-not-set-up-weak-password.ht... "4. Using Chinese input method : For example, the phonetic input method of the four" (I guess in Chinese, op. acqq) "words "My Password" is the combination of "ji32k7au4a83"." Sure, safe.…

Here's the entire translated version Using the above principles, how can we design a good password? Tip 1: Replace characters with ones that sound the same For example, you can replace the letter e in succeed with the number 1 {note this sounds the same in Mandarin}, so that it becomes succ11d, which is easy to remember and combines numbers and letters. Tip 2: Replace characters with ones that look the same For examp…

The hilarious part is these are used as examples to illustrate an algorithm, not to suggest you use them as actual secrets.

Re: The password “ji32k7au4a83” has been seen over a hundred times

#49

Post by ilamont » Mon, Mar 04, 2019, 2:21 AM UTC

swang wrote: post #34

This is using the zhuyin keyboard which most likely means Taiwanese users since Taiwan is probably the sole user of the zhuyin keyboard. Typing that out on a zhuyin keyboard gets you: ㄨㄛˇㄉㄜ˙ㄇㄧˋㄇㄚˇ In Pinyin that is wo3 de mi4ma3 Or in English "my password"

For the unfamiliar, "ㄨㄛˇㄉㄜ˙ㄇㄧˋㄇㄚˇ" is an example of "bopomofo" script, the phonetic system used to teach kids reading and pronunciation in Taiwan, and adapted to Chinese keyboard input (zhuyin). I learned it in the 1990s studying Mandarin in Taipei. It maps closely to pinyin romanization used in China (i.e., "ㄨㄛˇ" = "wo3" which is the sound in the Mandarin dialect for "我" and potentially other characters with the same pronunciation and tone. "我" means "I" or "me").

I am wondering if it was modeled after Hiragana/Katakana during Taiwan's colonial period?

Re: The password “ji32k7au4a83” has been seen over a hundred times

#50

Post by pishpash » Mon, Mar 04, 2019, 2:22 AM UTC

Some sites are throwaway (example: they force a sign-up). Don't assume all weak passwords used are not conscious decisions. Entropy is too precious to give up to throwaway sites of uncertain backend security.