71–80 of 97 posts
My password isn't on the list—it's a randomly generated 17-char string of alphanumeric and mixed case character.
Btw, you should all check out 1Password. Automates the process, syncs with all my devices and dropbox, and integrates with all the major browsers.
This is a brute force / dictionary attack. Only "bad" passwords have been cracked. My password isn't on the list—it's a randomly generated 17-char string of alphanumeric and mixed case character. Btw, you should all check out 1Password. Automates the process, syncs with all my devices and dropbox, and integrates with all the major browsers.
Earlier quoted context omitted.
Well, considering that 292 of the passwords contain mixed case, 79 of them are 12 characters or more (this one's nice: "qwe123QWE!@#"), 59 of them contain non-alphanumeric characters, and 6713 of the 8655 passwords posted are unique ... it's probably only a matter of time. Nice. I think it's time to upgrade all my passwords.
For what it's worth, my password was 8 random alphanumerics, and it's not in the list, while /.,mnbvcxz (12 alphanumerics with symbols) is there. The cracker must have some sort of algorithm that looks for consecutive patterns on the keyboard. It goes to show that the old rules - non-dictionary word, mixed case, etc - really don't cut it anymore. Psychologically, picking a password that has high entropy is quite diff…
I wasn't aware they could crack passwords that long though -- wasn't that supposed to take years, even with a GPU?
Earlier quoted context omitted.
So this is not the complete set of passwords, only the ones that have been cracked so far, using a dictionary? a dictionary + rules + time. yes (i assume - i have no inside knowledge). [...] passwords which were randomly generated are, and are likely to remain, safe? it depends on the length and range of characters. random passwords are still vulnerable if they are short and/or use a restricted range of characters. t…
Thanks. I was under the impression somehow that cracking the first few passwords would make it easier to crack the rest (by figuring out the salting scheme perhaps)? Also, if there is no restricted range of characters, and a solid, random password is used, how can the attacker know when they have broken it, short of trying them all against the actual server? Edit: Forget that last bit. I'm confusing myself.
i suspect some people here don't really know in any detail how password cracking works. you start with a dictionary. a good dictionary combines multiple passwords, slang, common patterns of keys on the keyboard, and old, known, passwords (so all the entries here will be added, for example). but that's just the start. the cracking programs also have rules. in simple terms these can be "shift to upper case" or "combine…
oops. "a good dictionary combines multiple passwords, ..." should be "a good dictionary combines multiple languages , ..." WTF. some fuckwit downvoted this? i wrote the text i am correcting. screw you. why do i bother to write useful comments? this place gets worse.
Could someone help this newbie understand why proper salting doesn't make this hard enough? And how does the cracker know they have the right password? Wouldn't they need to check it against the authentication mechanism or figure out the algorithm?
And because of this, if you choose a weak crypto method to hash your passwords (which is what MtGox did), then an attacker conveniently has the 3 things they need to attempt to crack the password: The algorithm, the salt and the hashed value all in the same place.
However, if a strong crypto is used (IE a computationally intensive and slow hash), then the fact that the algorithm, salt and hashed value are in the same place doesn't really weaken the passwords. With an expensive enough hash, even if the attacker has all the information about how to crack the password right in front of them, actually performing the necessary computation would be so expensive that a brute force attack is effectively protected against.
You can see more details about the format of the password strings and where the 3 parts of data are stored here: http://php.net/manual/en/function.crypt.php (the PHP page had the best explanation of my quick search, though this isn't just PHP specific)
Earlier quoted context omitted.
oops. "a good dictionary combines multiple passwords, ..." should be "a good dictionary combines multiple languages , ..." WTF. some fuckwit downvoted this? i wrote the text i am correcting. screw you. why do i bother to write useful comments? this place gets worse.
Just so you know, there's an edit link in each of your posts, though it goes away after enough time.
This is a brute force / dictionary attack. Only "bad" passwords have been cracked. My password isn't on the list—it's a randomly generated 17-char string of alphanumeric and mixed case character. Btw, you should all check out 1Password. Automates the process, syncs with all my devices and dropbox, and integrates with all the major browsers.
I always use unique passwords so I don't care that much if it gets broken.
Earlier quoted context omitted.
oops. "a good dictionary combines multiple passwords, ..." should be "a good dictionary combines multiple languages , ..." WTF. some fuckwit downvoted this? i wrote the text i am correcting. screw you. why do i bother to write useful comments? this place gets worse.
Just so you know, there's an edit link in each of your posts, though it goes away after enough time.