Hacker News Reader

Comment by meric | Hacker News Reader

Hmm it isn't complete; My password isn't on there yet. =\

Well, considering that 292 of the passwords contain mixed case, 79 of them are 12 characters or more (this one's nice: "qwe123QWE!@#"), 59 of them contain non-alphanumeric characters, and 6713 of the 8655 passwords posted are unique ... it's probably only a matter of time.

Nice. I think it's time to upgrade all my passwords.

"qwe123QWE!@#" is only nice until you look at the keyboard. First three qwerty letters. First three keys just above them. Then the same shifted.

Yeah, I caught that but it's still decent at meeting the usual password requirements, and it's almost as arbitrary as any other keyboard pattern.

I was surprised at how few randomly generated passwords there were in that list, if any. Like you mention, there's a lot of variants on qwerty/12345/!@#$%: 1qaz2wsx, Zaq1Xsw2, 1qazxsw23e, 1q2w3e, !@#$1234, etc.

"ZXasqw12!@" was about as random as it got from a quick scroll-through, and even that is basically just keys directly next to each other.

I assume randomness doesn't mean as much as sheer password length does when it comes to crackability, but I wonder if there's anything to be learned from this. Maybe only that random password generators tend to default to a safer (longer) length? :)

Random passwords are probably not going to be cracked by a run-through of John with a ruleset, which is likely similar to -- or exactly -- what was used to create this list.

These are salted FreeBSD MD5s (iterated hash); even with a powerful GPU, you're probably only going to be able to check a few hundred thousand per second at best.

For what it's worth, my password was 8 random alphanumerics, and it's not in the list, while /.,mnbvcxz (12 alphanumerics with symbols) is there. The cracker must have some sort of algorithm that looks for consecutive patterns on the keyboard.

It goes to show that the old rules - non-dictionary word, mixed case, etc - really don't cut it anymore. Psychologically, picking a password that has high entropy is quite difficult, and the crackers are only going to develop better algorithms in the future. I think using a good random generator is the only way to ensure you have a decent password these days.

I dunno, they managed to crack "G7io5639*%V64ioT5h9" -- 19 characters including lowercase, uppercase, numbers, and symbols. It doesn't seem to follow any pattern on a QWERTY layout -- maybe another layout?

I wasn't aware they could crack passwords that long though -- wasn't that supposed to take years, even with a GPU?

Yeah mine niether. I have confidence it won't end up there either. The way the difficulty and time hockeysticks up once you hit the low hanging fruit is amazing(<8 char, non complex, simple patterns and common passwords, dictionary words and number / symbol variants). http://www.rakkhis.com/2011/06/i-was-hacked-mtgox-bitcoin-3-...

Nor mine.

Nor mine. Of course mine was only 8 characters, character set of size 72, so only a "mere" 722,204,136,308,736 possible permutations. In any case the couple places that one was reused have been updated already, I'm still waiting for it to show up eventually.

nor mine, and it wasnt particularly secure either

Reply on news.ycombinator.com