191–200 of 229 posts
Earlier quoted context omitted.
It makes equally little sense to me, but "dragon" is routinely high on top password lists.
Computers are magic. Dragons are magic. QED. I'm actually kinda serious. Also, humans are monkeys. Ergo, "monkey" is popular.
There is an annual 'Passwords' conference [1], which I attended in 2012, and was blown away by quite how much researchers are able to do with these password lists. Unfortunately, I was equally impressed with what attackers are able to do with them as well. An important point is that attackers tend to have better lists, because they are the ones stealing and cracking them, and these lists make them increasingly better…
Earlier quoted context omitted.
> My bank uses 2Fa but it's on some fiddly little calculator device that I never have with me. I left my bank for this very specific reason (HSBC Aust) Grrr
Conversely I stay with my bank ( Nationwide ) because they use the device...
From http://www.cl.cam.ac.uk/~sjm217/papers/fc09optimised.pdf:
"We reverse engineered the UK variant of card readers and smart cards and here provide the first public description of the protocol. We found numerous weaknesses that are due to design errors such as reusing authentication tokens, overloading data semantics, and failing to ensure freshness of responses. The overall strategic error was excessive optimisation. There are also policy implications."
"The move from signature to PIN for authorising point-of-sale transactions shifted liability from banks to customers; CAP introduces the same problem for online banking. It may also expose customers to physical harm."
Meanwhile, I switched to a bank that uses SMS as a second factor and only where it's necessary: I don't need to use an inconvenient calculator.
Earlier quoted context omitted.
I'm curios to see if any of my accounts/passwords have been compromised
Wouldn't be surprised if one of these sites already has it https://breachalarm.com/ https://haveibeenpwned.com/ The author does not seem like the type of person who did the hacking himself to obtain these, but rather curated leaks into his database
Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…
Earlier quoted context omitted.
It makes equally little sense to me, but "dragon" is routinely high on top password lists.
That many people have noted the "dragon" phenomenon as strange, but we don't yet have an explanation, is perhaps stranger yet. In early days, one could have hypothesized that some basic "how to use passwords" resource had offered "dragon" as an example of a password, but after two decades of internet it seems unlikely that something like that could have had such a large effect.
Those of us who were kids in the 90's had dragons everywhere. Hell, we wore shirts with dragon patterns. Dragons were cool. Dragons were our passwords.
Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…
In other words, supposing that this data is representative of most peoples' password practices, just trying these 20 passwords gives you a ~18% success rate for any username. And... dragon. That's an unusual password to make the top-10 list. I think this might be a somewhat skewed sampling.
That might not be the case; not all passwords are created equal.
As an example, my password to some goofy online game that requires registration is nowhere near as strong as the password required to log into my work email account - for some things, I prioritize being able to type a password in quickly on a mobile device over the danger of someone breaking in and playing a low-scoring word in online scrabble.
For the lazy: grep -i 10-million-combos.txt
for the paranoïd lazy export HISTCONTROL=ignorespace grep -i 10-million-combos.txt (type a space before the command for it not to be logged in the history)
only 180896 people have 1234 in their password, thought there would be more