Hacker News Reader

Comment by underwater | Hacker News Reader

If any one else was confused by the poorly written article, he does the following.

* Download list of password hashes.

* Create list of seed words based on the subject matter for the site the passwords originate from (like "Afghanistan").

* Use Twitter search to build a dictionary of words related to the seed list.

* Feed dictionary through a script, john, that performs common letter substitutions and checks the md5 for each candidate against the original list of hashes.

I'm skeptical as to whether this is more effective than using the 4,400 most common English words.

View on HN

John isn't a script, it is a extremely fast C program that was designed to crack password hashes...

Thanks, on my first read through I thought "John" was doing substitutions and he was manually comparing hashes.

In this case their target was directly related to a niche topic (military) so a military wordset would likely have a higher hit rate.

Would it necessarily have more matches than a generic password dictionary? That would assume that military users are smart enough to not use the type of password they'd use on their personal email, but still stupid enough to use a dictionary word as a base.

He also didn't filter out non-military words. His 4,400 words would overlap considerably with list of common English words and could have been built by starting from any seed list.

I think it is an interesting concept. I can imagine this uncovering some jargon that is uncommon outside the niche, but unfortunately his experiments don't prove anything.

I would be interested in hearing the results based on derivations of just a single word, 'password' - I bet he could have nailed more than 2000 passwords on the common mashing of that word (123password, passwordabc, etc...)

Repeating his procedure using a word list consisting of just the word "password" (according to him the --rules option trys a bunch of variations) yields 18 passwords.

I thought the article was excellently written, one of the best, with clear screenshots and explanations of what he's doing. (I do code though.)

others here have easily replicated his procedure to compare with alternative ones (e.g. just based on the word 'password'), and attacked his methodology (he should have compared with twitter searches unrelated to the military to show what he's claiming, the effectiveness of targeted twitter searches).

this is great. it means his methodology is easy to understand/follow, to verify, attack/question, modify, and reproduce. it's extremely clear what he's doing, and what he's saying. what more could you ask?

Reply on news.ycombinator.com