Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Am Releasing Ten Million Passwords

xato.net

Post reply on HN
Print view View original

61–70 of 229 posts

Re: I Am Releasing Ten Million Passwords

#61

Post by meowface »

a3_nm wrote: post #50
meowface wrote: post #27

I don't understand exactly why it's necessary to release usernames along with the passwords, or why it's ethical to do so. Stripping the domain portion of email addresses does absolutely nothing when you can find the real email, and other accounts of the victim, by Googling the unique part of the email address. How does tying each password to its corresponding username help with password research, and does the value…

What about research to determine to what extent usernames with words in a certain language will tend to use passwords with words for the same language? (More generally, is there any connection between the bi- or trigram distribution on usernames and the one on passwords? In fact, do they just look the same, or could you tell given a string whether it's more likely a username or a password?) Do usernames of people wit…

I feel like most of those research questions could be answered if it was a "username -> password strength" mapping, in addition to a hash to study duplicate trends, rather than just "username -> password". Obviously there is no objective ranking of "password strength", but a decent approximation could be provided.

There are serious risks to having your username and password in a public list. Yes, all of these usernames and passwords were already technically publicly released, but to a lazy and ignorant script kiddie, finding or even being aware of those lists can be outside their grasp.

By aggregating everything into one list, you 1) increase the search engine visibility for all credentials, which means someone Googling the username of, say, an Internet commenter who pissed them off may find a plaintext password they could use to impact the person's life with much higher probability (I work in information security and have seen that happen on many occasions), 2) encourage script kiddies and fraudsters to spend time working through the list to find working accounts that other criminals have missed in the past decade, and 3) undo any work that paste sites like Pastebin and file sharing sites like Mediafire have done to remove copies of the database dumps. 1) may not apply if it strictly remains a torrent, but it'll probably be floating around public paste sites within a few days, which would likely mean search engine visibility for every username on it.

If even 0.01% of the users on this list have accounts compromised due to its release, then I don't think that cost justifies the research benefits relative to a more redacted version of the list.

Re: I Am Releasing Ten Million Passwords

#62

Post by jessaustin »

pgwhalen wrote: post #57
userbinator wrote: post #56

Earlier quoted context omitted.

In other words, supposing that this data is representative of most peoples' password practices, just trying these 20 passwords gives you a ~18% success rate for any username. And... dragon. That's an unusual password to make the top-10 list. I think this might be a somewhat skewed sampling.

It makes equally little sense to me, but "dragon" is routinely high on top password lists.

That many people have noted the "dragon" phenomenon as strange, but we don't yet have an explanation, is perhaps stranger yet. In early days, one could have hypothesized that some basic "how to use passwords" resource had offered "dragon" as an example of a password, but after two decades of internet it seems unlikely that something like that could have had such a large effect.

Re: I Am Releasing Ten Million Passwords

#63

Post by dvdhsu »

LeoPanthera wrote: post #46

Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…

Cool! I found the usernames interesting as well, since not many studies have been done on them. "dragon" is both a common username and password! In reply to another child post: the enormous number of "michael" passwords probably has to do with the smaller, but still large, number of "michael" usernames.

I'd run some more commands, to find out how many "michael"s use "michael" as their password, but I've got to head out now. Would be interesting -- anybody up for it?

(Ooh -- you could even juxtapose the usernames against common American names by decade [1], and probably derive some data about the ages of these users as well!)

(Furthermore -- what if we started keeping track of most common passwords by decade? That could be super interesting! I wonder if it's changed much!)

  $ export LC_ALL='C'
  $ 0-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 3044 infouniq -c | sort -nr | head -n 20
  2119 admin
  1323 michael
  1113 robert
  1095 2000
  1049 john
  1041 david
  967 null
  940 richard
  922 thomas
  901 chris
  866 mike
  843 steve
  832 dave
  816 daniel
  812 andrew
  797 george
  765 james
  735 mark
  730 dragon
1. http://www.ssa.gov/oact/babynames/decades/names1980s.html

Re: I Am Releasing Ten Million Passwords

#64

Post by vacri »

flavor8 wrote: post #36
charlespwd wrote: post #23

For the lazy: grep -i 10-million-combos.txt

And then history -c

... which will clear your entire history, which you probably don't want.

I don't know a shorter way, but to delete one line from history, do 'history', which shows the line numbers, then 'history -d LINE_NUM'.

Or, in bash, prepend the command with a space and it won't go into history.

Re: I Am Releasing Ten Million Passwords

#65

Post by joshmn »

lumpypua wrote: post #55
bikamonki wrote: post #54

It seems very useful for research and also practical uses, like how about a REST API with this dump? get will not only return true if it exists but how common and how weak it is, or will return a false for unique. Is there such a service out there?

Go make it! :)

I'm on it.

Re: I Am Releasing Ten Million Passwords

#66

Post by m8urn »

pgwhalen wrote: post #57
userbinator wrote: post #56

Earlier quoted context omitted.

In other words, supposing that this data is representative of most peoples' password practices, just trying these 20 passwords gives you a ~18% success rate for any username. And... dragon. That's an unusual password to make the top-10 list. I think this might be a somewhat skewed sampling.

It makes equally little sense to me, but "dragon" is routinely high on top password lists.

And it has been for 20 years

Re: I Am Releasing Ten Million Passwords

#67

Post by WillNotDownvote »

pgwhalen wrote: post #57
userbinator wrote: post #56

Earlier quoted context omitted.

In other words, supposing that this data is representative of most peoples' password practices, just trying these 20 passwords gives you a ~18% success rate for any username. And... dragon. That's an unusual password to make the top-10 list. I think this might be a somewhat skewed sampling.

It makes equally little sense to me, but "dragon" is routinely high on top password lists.

Computers are magic. Dragons are magic. QED.

I'm actually kinda serious.

Also, humans are monkeys. Ergo, "monkey" is popular.

Re: I Am Releasing Ten Million Passwords

#68

Post by hyperion2010 »

dj-wonk wrote: post #28

Forgive me for doing so, but allow me to ask some possibly ignorant questions and perhaps play the devil's advocate for a moment. What about this release will help? What are the compelling research problems in the space? We know users pick bad passwords. It seems to me the most compelling "problem" is hardly a research question -- isn't it about finding ways to encourage users pick strong passwords, not share them be…

The main issue is that attackers already have this data. They have a giant head start when when guessing passwords because just by looking at the username they can vastly reduce the search space. Whitehats and the public need to know how blackhats are reducing that search space. By making good faith publication and research on passwords risky (legally unattractive) we actively weaken security. I find it amusing that people find sharing password/username pairs questionable yet we don't seem to hold companies accountable when they loose millions of the things at once. Talk about a double standard. (RE: companies have lawyers and the little guy can get fucked for all anyone cares)

Re: I Am Releasing Ten Million Passwords

#69

Post by Slartibreakfast »

tptacek wrote: post #3

Barrett Brown was not convicted merely for linking to data on the web. He was convicted for three separate offenses: 1. Acting as a go-between for (presumably Jeremy Hammond) the Stratfor hacker and Stratfor itself, Brown misled Stratfor in order to throw the scent off Hammond. Having intimate knowledge of a crime doesn't make one automatically liable for that crime, but does put them in a precarious legal position i…

I don't know, sounds like he got off pretty lightly considering he threatened an FBI agent's children. I would expect the jail time would be a lot higher, but I guess I don't know what guides the court's decisions in these kinds of cases. I suppose five is enough time for him to figure out the error of his ways.
Post reply on HN