Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Am Releasing Ten Million Passwords

xato.net

Post reply on HN
Print view View original

171–180 of 229 posts

Re: I Am Releasing Ten Million Passwords

#171

Post by [deleted] »

jimmytucson wrote: post #91
burkaman wrote: post #82

Earlier quoted context omitted.

I think it's probably just a common thought process. I'll pick an animal -> dragons are the coolest animal -> nobody will ever guess dragon, this is way better than using my dog's name. Have you ever seen those online riddle things that say pick a color, pick a tool, wow I bet you picked a red hammer! We all grow in relatively similar societies, we all have relatively similar ways of thinking.

> I'll pick an animal -> dragons are the coolest animal -> nobody will ever guess dragon, this is way better than using my dog's name. I must confess, this is typically my exact thought process when crafting a password, a username, or even sometimes a nickname for people to call me in real life.

[deleted]

Re: I Am Releasing Ten Million Passwords

#174

Post by stef25 »

MarkMc wrote: post #147
IgorPartola wrote: post #102

Earlier quoted context omitted.

This is a horrible practice. You are trying to implement two factor auth, but with a static second factor that will not be considered private by most users. It is a huge burden on them to remember, and is providing you with dubious security at best, and actually providing a vector of attack at worst. Please don't do this.

Yes, it is two factor authentication with a static second factor that will not be considered private by most users. And yes, a 'real' two-factor authentication mechanism would provide better security. Unfortunately, due to market competition many websites simply cannot require 'real' two-factor authentication for all users. Here are the steps I would need to provide to my father to register for a typical '30-day free…

You could do it for him. Google Authenticator is great. My bank uses 2FA but it's on some fiddly little calculator device that I never have with me.

Some sites (Coibase) do 2FA with text message which is also great.

Re: I Am Releasing Ten Million Passwords

#175

Post by tfinniga »

pbreit wrote: post #123
m8urn wrote: post #41

Earlier quoted context omitted.

The main reason I have always included usernames and passwords in my research is because it allows me to analyze frequency data across multiple sites. Although I could have anonymized the usernames, I thought it would be best to keep them in. There is good value there. For example, there is quite a bit of overlap between usernames and passwords. Also, how many users include all or part of their usernames in their pas…

So how would you utilize such knowledge in the real world?

You could use it to create a password strength meter for your website, and enforce a certain strength.

Let's say it is common to include a subset of the username in passwords. Doing so would decrease the password strength and be disallowed.

Also, you could look at certain usernames and compute likelihood of certain dictionary words, and disallow them. For example, a user named Bob might be unlikely to use spanish words in a password, but a user named Jose might be more likely.

Being aware of methods/info used by crackers when designing secure systems will lead to stronger systems.

Re: I Am Releasing Ten Million Passwords

#176

Post by MarkMc »

thaumaturgy wrote: post #163
MarkMc wrote: post #97

Earlier quoted context omitted.

For sensitive sites, my preferred solution to this problem is to add a sequence of random characters to the User ID field. The user would then authenticate with something like this: User ID: John-CPE4E38J Password: snoopy For extra security the code would then move the random characters to the password so the authentication library would see this: User ID: John Password: snoopy-CPE4E38J In this way even an attacker w…

From a user experience standpoint, this is a bit of a nuisance. Users are already having real difficulty remembering all of their different usernames and passwords for different things. A password manager is still an alien thing to a lot of people. A lot of people still have a little text file somewhere, or they rely on messages stored deep in their mailboxes somewhere, or they have a little piece of paper they try d…

Yes, I agree it would a bit of a nuisance for users to perform the 'reset password' after they switch computers, re-install the operating system, etc.

And yes, I'm trying to solve the two problems you mentioned: (a) someone brute-forcing user accounts from the outside; and (b) someone gaining access to the server database and thereby gaining access to other sites where the user has the same credentials. If it is true that "just trying these 20 passwords gives you a ~18% success rate for any username" then it seems to me that throttling brute-force attempts would not be very effective.

Re: I Am Releasing Ten Million Passwords

#177

Post by benbristow »

LeoPanthera wrote: post #46

Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…

Heh. I use 'password' for when I'm purposely trying to make things unsecure (Like being nice and sharing my unlimited data via my phone's wifi hotspot on public transport).

Re: I Am Releasing Ten Million Passwords

#179

Post by seriocomic »

stef25 wrote: post #174
MarkMc wrote: post #147

Earlier quoted context omitted.

Yes, it is two factor authentication with a static second factor that will not be considered private by most users. And yes, a 'real' two-factor authentication mechanism would provide better security. Unfortunately, due to market competition many websites simply cannot require 'real' two-factor authentication for all users. Here are the steps I would need to provide to my father to register for a typical '30-day free…

You could do it for him. Google Authenticator is great. My bank uses 2FA but it's on some fiddly little calculator device that I never have with me. Some sites (Coibase) do 2FA with text message which is also great.

> My bank uses 2Fa but it's on some fiddly little calculator device that I never have with me.

I left my bank for this very specific reason (HSBC Aust)

Grrr

Re: I Am Releasing Ten Million Passwords

#180

Post by jcm1317 »

dvdhsu wrote: post #63
LeoPanthera wrote: post #46

Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…

Cool! I found the usernames interesting as well, since not many studies have been done on them. "dragon" is both a common username and password! In reply to another child post: the enormous number of "michael" passwords probably has to do with the smaller, but still large, number of "michael" usernames. I'd run some more commands, to find out how many "michael"s use "michael" as their password, but I've got to head o…

For some reason I seem to be getting different values then you. However from what I got, there was only a single instance of a username 'michael' having a password 'michael'.

HOWEVER, of all of the people whose password is 'michael' 83 seem to CONTAIN the str 'michael'.

Of the set of usernames 'michael' there are 20 whose passwords contain the string 'michael'

Of the set of usernames containing the string 'michael' there are 276 passwords that contain the string 'michael'

I honestly expected much more.

Post reply on HN