Hacker News Reader

The fact that some of those passwords appear very strong also means they weren't bruteforced and therefore most likely stored in plaintext. I guess even the FBI have sloppy programmers...

They say on the pastebin that one connexion sent passwords in clear text (through asipx-webadmin), so they probably were read there. At least it was probably an entry point.

3 and 4 would not take long to be brute forced by a dictionary attack, I think. Too many people use qwerty on their password, so it's probably high rated on a dictionary attack.

3 and 4 are weak because we have pretty good heuristics on how passwords are composed so it wouldn't take much longer to brute-force them than it would to do password123.

I'd be interested to see if either 3 or 4 appear on existing password dictionaries.