Reminds me about the tidbit about "strong password" rules, like one each of small letter, capital letter, digit or symbol. Like: "Password2016". Really strong. It's even longer than 8 letters.
Analyzing the Patterns of Numbers in 10M Passwords (2015)
21–30 of 41 posts
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#22When it comes to visualisation of numbers distribution, every time I recall the Secret Live of Numbers [0] applet by Golan Levin from 2002. Haven't seen anything comparable ever since. So pleasant to browse through the data I'm tempted to try to make the java applet runtime working again now. (At least we can enjoy some screenshots [1])
[0] http://www.flong.com/projects/slon/ [1] https://www.flickr.com/photos/golanlevin/sets/72157594388612...
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#23Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#24The fact that there are peaks at 6 and 8 digits per password is probably due the fact that dates can be represented as DDMMYY and DDMMYYYY respectively, rather than imply that humans are better at remembering an even number of digits.
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#25Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#26An interesting peak in the '7XX' subset is '768' which is an important number for muslims. [1] I also noticed mild peaks at '258' and '852' which are vertical sequences on a numeric keypad - in the 4-digit PIN dataset there was a distinct peak at '2580' as well - as well as another at '951' for the diagonal sequence.
[1] http://islam.stackexchange.com/questions/799/what-does-786-m...
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#27The problem with this type of analysis is that it treats the 10million passwords as if they are representative of all passwords. A more descriptive title would be:
"Analyzing the Patterns of Numbers in 10 Million passwords that were not randomly selected from an unknown number of accounts"
One of the first cracking rules in john is append a "1" to dictionary word. "123" is one of the few multidigit strings that john appends in the default ruleset. Furthermore the first 5 million passwords were used to generate a character frequency database for cracking the second 5 million.
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#28The problem with this type of analysis is that it treats the 10million passwords as if they are representative of all passwords. A more descriptive title would be: "Analyzing the Patterns of Numbers in 10 Million passwords that were not randomly selected from an unknown number of accounts" One of the first cracking rules in john is append a "1" to dictionary word. "123" is one of the few multidigit strings that john…
The 10M dump was collected from a wide variety of sources to avoid sampling bias.
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#29The problem with this type of analysis is that it treats the 10million passwords as if they are representative of all passwords. A more descriptive title would be: "Analyzing the Patterns of Numbers in 10 Million passwords that were not randomly selected from an unknown number of accounts" One of the first cracking rules in john is append a "1" to dictionary word. "123" is one of the few multidigit strings that john…
The 10M dump was collected from a wide variety of sources to avoid sampling bias.
How did you "avoid" sample bias? How many of the passwords come from databases that were dumped in cleartext or cracked with 100% success? Meaning every account on that system was included in cleartext or 100% of the passwords from a dump were cracked.
The reason I ask is that the dataset you analyzed does not make this claim:
"Now not all of these passwords are plaintext. Many dumps include passwords in a hashed format that requires you to crack them yourself." https://xato.net/a-glimpse-into-the-world-of-internet-passwo...
Re: Analyzing the Patterns of Numbers in 10M Passwords (2015)
#30slightly off topic, what tool/lib did you use to make the charts?"