Hacker News Reader

Comment by tansey | Hacker News Reader

Worth noting that these passwords are all MD5 encrypted but not salted. There were also no creation rules enforced, as a quick check reveals:

Highest reused password count: 12023 "stratfor"? 12023 "password"? 517 "password1"? 46 "Password1"? 24 "123456"? 625 "12345678"? 74 "jesus"? 2 "love"? 7 "war"? 1 "michael"? 39 "america"? 7 "xbox360"? 0 "heroes"? 0

Those last 2 are popular for the battlefield heroes dataset and other gaming-related ones, so I keep them in my script as gaming sites are both highly targeted and usually poorly secured.

Anyway, it's clear that no rules were enforced as a 3-letter dictionary word like "war" would never be allowed by any rule creation system. The fact that "stratfor" was used by nearly 1.4% of all accounts (!) tells me that either their users did not value these accounts or they simply have no idea how passwords are supposed to work.

View on HN

I've been a Stratfor subscriber on and off since they got started about 15 years ago (I was 14 years old at the time). The last time around I got a new subscription, Stratfor set a new password for me, and it was... "stratfor".

This is just about the only bad thing I have to say about Stratfor. Being a long-time subscriber, I am always a few steps ahead of basically everyone else when it comes to global politics, and this has been very useful and enjoyable over the years.

One thing worth pointing out is that a Stratfor account like mine does not contain any sensitive information. It gives me access to exactly the same Stratfor reports as any other subscriber. As far as I know, it would not be possible to obtain e.g. my credit card details by using that password.

If the account does not hold any "vital" information, password "stratfor" could be quite a harmless password to leak, as I couldn't imagine anyone using that password for any other site/account. Although I don't know what user information is contained within the account.

Anyway, it is stupid to use such passwords and it tells something about the persons using those. Maybe they would use site names as passwords on other sites also.

It was just a password to online news articles, not to my bank account...

In your case, sure.

> users did not value these accounts

Why would they value their password to one of 30ish different systems/websites?

How did you get a breakdown of all the passwords used? Did you try to crack them yourself, or has the cracked passwords been posted? I'm trying to figure out if my own password has been compromised.

I assume that he just grepped for the md5 hash of the common passwords he tried.

e.g., grep `md5 -s 'password' | cut -d ' ' -f 4` password_file | wc -l

All you need to do to figure out the hash for a password is take the MD5 hash of it. My guess is the commenter you replied to just took some common passwords and some no-brainers and did a quick little "find all" for each hash.

Here's a tool you can use to generate MD5 hashes for given passwords: http://www.iwebtool.com/md5?string=stratfor

Going from the hashes to the passwords requires brute forcing, dictionary attacks, that sort of thing.

Assume it has.

Bad passwords really scare me.

Reply on news.ycombinator.com