Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Am Releasing Ten Million Passwords

xato.net

Post reply on HN
Print view View original

91–100 of 229 posts

Re: I Am Releasing Ten Million Passwords

#91

Post by jimmytucson »

burkaman wrote: post #82
pgwhalen wrote: post #57

Earlier quoted context omitted.

It makes equally little sense to me, but "dragon" is routinely high on top password lists.

I think it's probably just a common thought process. I'll pick an animal -> dragons are the coolest animal -> nobody will ever guess dragon, this is way better than using my dog's name. Have you ever seen those online riddle things that say pick a color, pick a tool, wow I bet you picked a red hammer! We all grow in relatively similar societies, we all have relatively similar ways of thinking.

    > I'll pick an animal -> dragons are the coolest animal -> nobody will ever guess dragon, this is way better than using my dog's name.
I must confess, this is typically my exact thought process when crafting a password, a username, or even sometimes a nickname for people to call me in real life.

Re: I Am Releasing Ten Million Passwords

#92

Post by pthreads »

libria wrote: post #74
LeoPanthera wrote: post #46

Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…

I'm surprised (disappointed?) only 1 person used "correcthorsebatterystaple".

That is terrible, he/she used the same phrase as in the example!

Re: I Am Releasing Ten Million Passwords

#93

Post by Buge »

stevecalifornia wrote: post #26

When I first got on the Internet in 1994 I used the same password for everything for the next decade before I became security conscious (now I have a random, strong, unique password for every service). Anyways, that password is not in this list. I have found it in other password dumps before. So, I don't know what to think.

This is 10 million out of 1 billion that he has.

So there is only a 1% chance of a leaked account getting in this list.

Re: I Am Releasing Ten Million Passwords

#94

Post by Buge »

stevecalifornia wrote: post #26

When I first got on the Internet in 1994 I used the same password for everything for the next decade before I became security conscious (now I have a random, strong, unique password for every service). Anyways, that password is not in this list. I have found it in other password dumps before. So, I don't know what to think.

This is 10 million out of 1 billion that he has.

So there is only a 1% chance of a leaked account getting in this list.

Re: I Am Releasing Ten Million Passwords

#96

Post by whoopdedo »

jessaustin wrote: post #62
pgwhalen wrote: post #57

Earlier quoted context omitted.

It makes equally little sense to me, but "dragon" is routinely high on top password lists.

That many people have noted the "dragon" phenomenon as strange, but we don't yet have an explanation, is perhaps stranger yet. In early days, one could have hypothesized that some basic "how to use passwords" resource had offered "dragon" as an example of a password, but after two decades of internet it seems unlikely that something like that could have had such a large effect.

Part of it may be where the passwords are scraped from. If "dragon" has some relevance to the field then there's a higher probability that it will be used by people working in that field. This list is a sample of passwords from compromised databases not from all databases in the world.

I wonder about the prevalence of "allsop" as a password. I came across it in a computer I was repairing last week and it shows up 159 times in this list. Is it from the acronym SOP? Or because of the company that makes mouse pads?

Re: I Am Releasing Ten Million Passwords

#97

Post by MarkMc »

userbinator wrote: post #56
LeoPanthera wrote: post #46

Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…

In other words, supposing that this data is representative of most peoples' password practices, just trying these 20 passwords gives you a ~18% success rate for any username. And... dragon. That's an unusual password to make the top-10 list. I think this might be a somewhat skewed sampling.

For sensitive sites, my preferred solution to this problem is to add a sequence of random characters to the User ID field. The user would then authenticate with something like this:

  User ID: John-CPE4E38J
  Password: snoopy
For extra security the code would then move the random characters to the password so the authentication library would see this:

  User ID: John
  Password: snoopy-CPE4E38J
In this way even an attacker who gains full access to the server database would be unable to read the passwords (assuming they have been hashed well).

Also, the User ID can be stored in a cookie so that the User ID field on screen is pre-populated and the user only has to type "John-CPE4E38J" when he switches to a new computer.

More details here: http://security.stackexchange.com/questions/80352/is-it-a-ba...

Re: I Am Releasing Ten Million Passwords

#99

Post by bikamonki »

akerl_ wrote: post #90
bikamonki wrote: post #88

Earlier quoted context omitted.

Correct, but every site where you signup does that and I do not think anyone cares. Maybe such API will not be for end users but for other apps to run signup forms against it and help users choose a better one. In any case, the whole password deal is broken. I now use my own offline pwd generator for the "important" sites but I guess I am not the average Internet user.

What site out there is sending my plaintext passwords to a 3rd party service to validate their strength?

Hopefully none, and hopefully they are all following best practices to protect your password, but you trust them regardless. Besides, who said plain text, such service could use ssl.

Re: I Am Releasing Ten Million Passwords

#100

Post by diminoten »

meowface wrote: post #27

I don't understand exactly why it's necessary to release usernames along with the passwords, or why it's ethical to do so. Stripping the domain portion of email addresses does absolutely nothing when you can find the real email, and other accounts of the victim, by Googling the unique part of the email address. How does tying each password to its corresponding username help with password research, and does the value…

I dunno if he should have said "released", because he's not releasing any new data. Everything he's posted is already available to anyone with a search engine and a bit of curiosity.

So if you're concerned that information which wasn't previously public is now public, you can be at ease -- all of this data was not only public already, but less "cleaned up".

Post reply on HN