Live data from Hacker News

That 16B password story (a.k.a. "data troll")

troyhunt.com

11–14 of 14 posts

Re: That 16B password story (a.k.a. "data troll")

#11
post #6

In other words, 2.7B -> 109M is a 96% reduction from headline to people. Could we apply the same maths to the 16B headline? I mean there’s not 16B people in the world, so a row per person can be ruled out pretty easily

> I mean there’s not 16B people in the world, so a row per person can be ruled out pretty easily In a hypothetical "master dump", a mix of all the dumps ever leaked, you'd expect dozens if not more entries for every "real person" out there. Think about how many people had a yahoo account, then how many had several yahoo accounts, and then multiply it with hundreds of leaks out there. I can see the number getting into…

> There's lots to be learned about wordwordnumber wordnumbernumber, and so on.

i had a plan to do statistical studies of some password dumps to try and make a "compressed password list" that could generate password guesses on the fly, and i forgot why i didn't do it, but i'm sure it's because the "model" - the statistical dataset upon which the program would generate output, wouldn't really be that much smaller; at least not with my poor maths skills.

I'm assuming that someone who really knew what they were doing could get close to 20% - 15% of the full password list. I doubt i could do better than just compressing the dataset and extracting it on the fly.

Re: That 16B password story (a.k.a. "data troll")

#12

Earlier quoted context omitted.

> I mean there’s not 16B people in the world, so a row per person can be ruled out pretty easily In a hypothetical "master dump", a mix of all the dumps ever leaked, you'd expect dozens if not more entries for every "real person" out there. Think about how many people had a yahoo account, then how many had several yahoo accounts, and then multiply it with hundreds of leaks out there. I can see the number getting into…

> There's lots to be learned about wordwordnumber wordnumbernumber, and so on. i had a plan to do statistical studies of some password dumps to try and make a "compressed password list" that could generate password guesses on the fly, and i forgot why i didn't do it, but i'm sure it's because the "model" - the statistical dataset upon which the program would generate output, wouldn't really be that much smaller; at l…

> I doubt i could do better than just compressing the dataset and extracting it on the fly.

The meta in that field is to extract "rules" (i.e. for hashcat) from datasets. Then you run the rules over the encrypted dumps. Rules can be word^number^number, word^number^word^number, or letter^upper^number^lower... etc. Then you build a dictionary and dict + rules = passwords.

Pretty sure you can extract some nice signals nowadays with embeddings and what not.

Re: That 16B password story (a.k.a. "data troll")

#14
I am very confused.

> Everything (and I mean it) from that news report went through yours truly.

> Bob is a quality researcher

> The headlines implying this was a massive breach are misleading

But the headlines implying it are literally in the cybernews article, which is the source of it all? Why does the article talks about "the mass media" throughout the length of it, if it's the original source that was misleading?

Post reply on HN