Hacker News Reader

Comment by lucasgonze | Hacker News Reader

This list is immediately useful for validating user-created new passwords. Just stop with the bizarre rules about having uppercase, lowercase, symbols, numbers, length, etc. Instead require a string not in the top 10K (or 100K, or 1M) most popular.

View on HN

"Your password must be between 12 to 46 characters long and must include at least one number, upper case character, special character, kanji character, rune and quadratic equation"

"It also needs to be changed every 60 days and cannot be the same as one previously used in the past year."

(Promptly changes around variables in quadratic equation for the umpteenth time, leaves the rest of the password the same.)

I used to just tack on Aa$0 to the end of all my (already good) passwords to satisfy these idiotic rules. Until one website decided that '0' was not a number, and then I had to change everything to Aa$1.

Until a website thinks a 1 is an lower case L, and you have the same problem all over again.

I tend to revolt against this kind of bullshit by creating terrifyingly primitive, pathetic passwords, and flagrantly sharing what my password is, in front of relevant admins, while complaining loudly about the concept of "character diversity," as a way of fomenting popular rebellion.

When I'm met with periodic expiration, I employ constant direct password assistance as a means of unpopular two-factor authentication, to piss people off, and stir the pot.

I then fail my password reset as many times as necessary to recover my preferred password for that system, to enforce to freedom of password selection.

I control my password. Me.

Not you. Me.

Im glad Im not the only one that does this.

But it cannot include ",',$,;,<,space,etc.. because or engineers are still not 100% confident in our input sanitization.

You'd be surprised how many websites won't accept SELECT or DROP as valid usernames.

And you can be like HSBC which along with not accepting special characters, also saves and validates your password only in lowercase

And Citibank internet banking passwords are case-insensitive. (Atleast I can vouch for Citibank India)

Facebook passwords are also case-interchangable. i.e. PasswoRd5 is same aa pASSWOrD5 both will work. Idea is if Caps lock is left ON by mistake.

This is precisely why I don't use ubNUTu.

Since the list is only rarely updated, this seems a perfect application Botelho's for minimal perfect hashing algorithm[1]. At about 8 bits per item storage and constant lookup it would be quite practical to use the top 32 Million list (appeared at least 10 times).

[1] http://cmph.sourceforge.net/papers/tr06.pdf

Speaking of rarely updated - version two will come out mid-July at the latest.

I'm also going to attempt to attribute the sources to given countries or at least language families. The list as it stands has a heavily US-centric bias.

I plan to grep through it and pull out things like Cyrillic or Arabic characters, and then repeat the process using only those characters. That's not to say that everyone who uses Arabic or Cyrillic characters is guaranteed to use them, but it's more specific.

If "password" is #2 in the world, perhaps пароль (password) will be the #2 most popular password with Russian Cyrillic Characters

I wonder about how to package your data as developer tools.

There should be libraries in any language used to develop systems which validate user-entered passwords.

Dropbox has their zxcvbn method which incorporates a list of 30k of the most common passwords

https://github.com/dropbox/zxcvbn

It looks like they gzip the file over the wire and then work with it uncompressed. That's probably a reasonable choice given they use only 30,000 passwords.

Note that this password list is valid rather for English speaking world.

Reply on news.ycombinator.com