Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Am Releasing Ten Million Passwords

xato.net

Post reply on HN
Print view View original

81–90 of 229 posts

Re: I Am Releasing Ten Million Passwords

#81

Post by tptacek »

dmix wrote: post #80
tptacek wrote: post #79

Earlier quoted context omitted.

According to Kim Zetter: The first charge is a new one and relates to assistance Brown allegedly gave the person who hacked Stratfor “in order to hinder and prevent [his] apprehension, trial and punishment.” According to the government Brown worked to create confusion about the hacker’s identity “in a manner that diverted attention away from the hacker,” which included communicating with Stratfor after the hack in a…

Thanks. Seems like during sentencing this was the key point related to accessory: > Loss amount of more then $400,000 but less than $1M This was worth +14 points which was higher than any other single guideline - including threatening an FBI agent. I guess the lesson here is that if the crime at hand involved any significant amount of money then even if your role was minor (and after the fact) you can still get serio…

Yes. This is a real problem with the federal sentencing guidelines.

Re: I Am Releasing Ten Million Passwords

#82

Post by burkaman »

pgwhalen wrote: post #57
userbinator wrote: post #56

Earlier quoted context omitted.

In other words, supposing that this data is representative of most peoples' password practices, just trying these 20 passwords gives you a ~18% success rate for any username. And... dragon. That's an unusual password to make the top-10 list. I think this might be a somewhat skewed sampling.

It makes equally little sense to me, but "dragon" is routinely high on top password lists.

I think it's probably just a common thought process. I'll pick an animal -> dragons are the coolest animal -> nobody will ever guess dragon, this is way better than using my dog's name.

Have you ever seen those online riddle things that say pick a color, pick a tool, wow I bet you picked a red hammer! We all grow in relatively similar societies, we all have relatively similar ways of thinking.

Re: I Am Releasing Ten Million Passwords

#83

Post by avid8 »

Even if this release has no implications for security, I think it may raise legitimate concerns for users' privacy. No doubt most users expect that their passwords will be known only to themselves. Many of the usernames contain real names, and many more could probably be traced to them. Ian Watkins was found to have "gloated" about his crimes in his password. With time and attention, I wonder whether such "dark secrets" could be found in this list.

Re: I Am Releasing Ten Million Passwords

#84

Post by swatow »

exogen wrote: post #44
detaro wrote: post #32

Earlier quoted context omitted.

Probably to find out how many people do stuff like type their username backwards as a password/what kind of patterns they use. If that is useful enough information to warrant publishing data like this is debatable, yes.

Also interesting, how features of a username might correlate with password strength. Who do you think uses a stronger password, someone with the username "carguy551978" or someone with the username "w1ntermute"?

carguy followed by the 24'th n such that 1 + n + n^13 is prime, followed by the 34'th such n? I would expect a very, very strong password from someone who picks their username like that.

(see https://oeis.org/search?q=__%2C+551%2C+__%2C+978&sort=&langu...)

Re: I Am Releasing Ten Million Passwords

#85

Post by 300bps »

LeoPanthera wrote: post #46

Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…

Don't read too much into this. My main email account is in the original list that was posted in October of 2014. My account that is listed is myname@gmail.com. The password though is not the password to myname@gmail.com but rather to my "junk" site password.

For almost any site I have an account, I use a strong, unique password. For sites that I don't care about at all AND that I suspect have security problems I use a standard common insecure password. It is that common insecure password that is paired with my gmail account.

Re: I Am Releasing Ten Million Passwords

#86

Post by nadaviv »

stephentmcm wrote: post #29
cwarrior wrote: post #11

Earlier quoted context omitted.

What's your password? I could check the file to see if it's there. I found one of mine. Does anybody know from where these passwords are from?

hunter2

For those not familiar: http://bash.org/?244321

Re: I Am Releasing Ten Million Passwords

#87

Post by [deleted] »

avid8 wrote: post #83

Even if this release has no implications for security, I think it may raise legitimate concerns for users' privacy. No doubt most users expect that their passwords will be known only to themselves. Many of the usernames contain real names, and many more could probably be traced to them. Ian Watkins was found to have "gloated" about his crimes in his password. With time and attention, I wonder whether such "dark secre…

[deleted]

Re: I Am Releasing Ten Million Passwords

#88

Post by bikamonki »

akerl_ wrote: post #73
bikamonki wrote: post #54

It seems very useful for research and also practical uses, like how about a REST API with this dump? get will not only return true if it exists but how common and how weak it is, or will return a false for unique. Is there such a service out there?

This seems a bit like testing if your parachute was packed properly by deploying it. Once I've sent my password at a 3rd party API, it doesn't much matter what the API says: my password is no longer secure.

Correct, but every site where you signup does that and I do not think anyone cares. Maybe such API will not be for end users but for other apps to run signup forms against it and help users choose a better one. In any case, the whole password deal is broken. I now use my own offline pwd generator for the "important" sites but I guess I am not the average Internet user.

Re: I Am Releasing Ten Million Passwords

#89

Post by m8urn »

meowface wrote: post #76
m8urn wrote: post #72

Earlier quoted context omitted.

As I explained in the article I seriously doubt that any more than a tiny number of these passwords are still valid. And there is no reason for them to be, having already been widely available, indexed (and cached) by every search engine, archived at archive.org, and downloaded by thousands or tens of thousands of people. Anyone who would use this data maliciously probably already has it. Much of this data is the sam…

>Anyone who would use this data maliciously probably already has it. You might be surprised. The fact that these dumps are supposedly quite old certainly mitigates the risk, but I've seen cases of primary email accounts being taken over from a plaintext password in a dump 5+ years old. No one ever tried it on the email because it wasn't in the dump and wasn't identical to the username, though it was very close. Aggre…

First of all, a good number of these passwords were simply gathered through google. Some were gathered via the archive.org archive of pastebin pastes and their normal web page archive. Some were from forums that were located via google. This data is already out there, being aggregated doesn't make it any easier to hack these people.

Try searching for "Cucum01:Ber02" or "shawman:badman" and you will see how many passwords are indexed. I have hundreds of searches like these that I monitor and scrape.

Second, I regularly share my data with the owners of password checking sites such as haveibeenpwned to make sure users are able to be aware of these breaches. Releasing this data isn't something I have taken lightly, I debated it for years. I have weighed the risks and felt it was important to release the raw data, although not everyone will agree with me on this. I made a good effort to minimize the risks to actual users.

Finally, keep in mind that most users are already at risk simply because they have bad passwords. Ten percent of users have a password on the top 1000 list. A large percentage of users are at risk because the websites they are on don't have proper security. This is how people get hacked, not because of a password found on this list.

Re: I Am Releasing Ten Million Passwords

#90

Post by akerl_ »

bikamonki wrote: post #88
akerl_ wrote: post #73

Earlier quoted context omitted.

This seems a bit like testing if your parachute was packed properly by deploying it. Once I've sent my password at a 3rd party API, it doesn't much matter what the API says: my password is no longer secure.

Correct, but every site where you signup does that and I do not think anyone cares. Maybe such API will not be for end users but for other apps to run signup forms against it and help users choose a better one. In any case, the whole password deal is broken. I now use my own offline pwd generator for the "important" sites but I guess I am not the average Internet user.

What site out there is sending my plaintext passwords to a 3rd party service to validate their strength?
Post reply on HN