[deleted]
I Am Releasing Ten Million Passwords
181–190 of 229 posts
Re: I Am Releasing Ten Million Passwords
#182Hunter6 is used as a password 9 times...
Re: I Am Releasing Ten Million Passwords
#183It seems very useful for research and also practical uses, like how about a REST API with this dump? get will not only return true if it exists but how common and how weak it is, or will return a false for unique. Is there such a service out there?
Nice idea. Working on a simple Rails API now that will return a JSON response. Will take a while to import all the passwords though.
Currently got it returning this JSON: {"found":true,"password":"test","count":117}
Re: I Am Releasing Ten Million Passwords
#184Earlier quoted context omitted.
"threats may not be punished if a reasonable person would understand them as obvious hyperbole". Obviously, I don't know what the court would have held in this case, but it seems possible it would have held that this was "obvious hyperbole".
Could someone with legal background please explain the concept of "protected speech"? I thought the Constitution is "where the buck stops", the Supreme Law. It takes precedent over any law, legal theory, precedent, tradition, etc. The first amendment, as written, outright "enjoins" Congress from creating any "exceptions" or define what kinds of speech are actually protected. I also think the Constitution provides one…
The buck stops where the Supreme Court says it does. They are the ones who get to decide the meaning of the words in laws and the Constitution. As a side note, the first amendment does not bind the states from creating laws that limit speech as it is written that 'Congress shall make no law...'. This comes from the Doctrine of Incorporation[1] based off of precedents set by interpretations of the Fourteenth Amendment. Now there's an amendment with an interesting history.
[1] http://en.wikipedia.org/wiki/Incorporation_of_the_Bill_of_Ri...
Re: I Am Releasing Ten Million Passwords
#185Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…
In other words, supposing that this data is representative of most peoples' password practices, just trying these 20 passwords gives you a ~18% success rate for any username. And... dragon. That's an unusual password to make the top-10 list. I think this might be a somewhat skewed sampling.
You forgot a zero:
>>> (55893+20785+13582+13230+11696+10938+6432+5682+4796+4191+3845+3734+3664+3655+3330+3206+3136+3126+3050+3002) / 1e7
0.0180973
Re: I Am Releasing Ten Million Passwords
#186I don't understand exactly why it's necessary to release usernames along with the passwords, or why it's ethical to do so. Stripping the domain portion of email addresses does absolutely nothing when you can find the real email, and other accounts of the victim, by Googling the unique part of the email address. How does tying each password to its corresponding username help with password research, and does the value…
I'm curios to see if any of my accounts/passwords have been compromised
Wouldn't be surprised if one of these sites already has it
https://breachalarm.com/ https://haveibeenpwned.com/
The author does not seem like the type of person who did the hacking himself to obtain these, but rather curated leaks into his database
Re: I Am Releasing Ten Million Passwords
#187Just a thought here. As far as I can tell, many bona fide security researchers seem to be independent consultants. Would they be less at risk of prosecution if they were handling sensitive data such as user names and passwords under the coverage of universities and/or similar accredited institutions operating under protocols as to who can and cannot access the data?
It would probably be more security theatre than actual security, but I'd imagine that it would at least keep the FBI happy.
Re: I Am Releasing Ten Million Passwords
#188Barrett Brown was not convicted merely for linking to data on the web. He was convicted for three separate offenses: 1. Acting as a go-between for (presumably Jeremy Hammond) the Stratfor hacker and Stratfor itself, Brown misled Stratfor in order to throw the scent off Hammond. Having intimate knowledge of a crime doesn't make one automatically liable for that crime, but does put them in a precarious legal position i…
It's interesting that you say his sentence was "unjust" given that you always seem to defend crazy sentences as "not being the real ones anyway".
Also those three sound like incredibly weak charges, and yet you somehow defend the prosecution over them.
Re: I Am Releasing Ten Million Passwords
#189Barrett Brown was not convicted merely for linking to data on the web. He was convicted for three separate offenses: 1. Acting as a go-between for (presumably Jeremy Hammond) the Stratfor hacker and Stratfor itself, Brown misled Stratfor in order to throw the scent off Hammond. Having intimate knowledge of a crime doesn't make one automatically liable for that crime, but does put them in a precarious legal position i…
It's interesting that you say his sentence was "unjust" given that you always seem to defend crazy sentences as "not being the real ones anyway". Also those three sound like incredibly weak charges, and yet you somehow defend the prosecution over them.
Is it because I say his sentence was unjust given that me always seem to defend crazy sentences as not being the real ones anyway that you came to me?
Earlier you said I say his sentence was unjust given that me always seem to defend crazy sentences as not being the real ones anyway?
Maybe your life has something to do with this.
Re: I Am Releasing Ten Million Passwords
#190Earlier quoted context omitted.
You could do it for him. Google Authenticator is great. My bank uses 2FA but it's on some fiddly little calculator device that I never have with me. Some sites (Coibase) do 2FA with text message which is also great.
> My bank uses 2Fa but it's on some fiddly little calculator device that I never have with me. I left my bank for this very specific reason (HSBC Aust) Grrr
Conversely I stay with my bank ( Nationwide ) because they use the device...