Hacker News Reader

Comment by oconnore | Hacker News Reader

A lot of these are good. Some not so much...

    passwords123
    passwored12
    password$qwerty
    qwertylol@me
    passwords123456
    password123
    password111111

View on HN

This is a fake news dude. Check this out: http://news.ycombinator.com/item?id=4678064

Not a single sentence, can it be that they allow characters like ( and % but not whitespace? Boggles my mind that people don't use more sentences.

There's one ilovemydaughternancy with no spaces. Why would you want spaces?

I find that typing a bunch of words with spaces is faster than with words. I guess my brain is wired by now to automatically press the spacebar between words.

There's also lovenancy18. Someone will have a long talk with his daughter.

Sentences are easier to remember. Yet grammatically correct sentences can give you things like capital letter, whitespaces and even periods.

Unfortunately, they also cut down on the search space quite a bit.

to make it more natural to type a passphrase

Personally I don't like spaces because every now and then I find a service that doesn't accept them - ex: you can't have spaces in your IRC password. ASCII printable characters are enough for me.

Look at the difference in time when using a simple 'helloworld' password with and without spaces. https://www.grc.com/haystack.htm

Also, for some more reading on why using spaces will make it infinitely more difficult for hackers to try and gain access: http://www.baekdal.com/insights/password-security-usability

What's wrong with 3 and 4?

It appears that, in general, the FBI staff are setting reasonable passwords. There are a few passwordNNN types but the majority are adequate and, in my opinion, would hold up well against a brute force vector, which is the primary purpose of password complexity.

The fact that some of those passwords appear very strong also means they weren't bruteforced and therefore most likely stored in plaintext. I guess even the FBI have sloppy programmers...

They say on the pastebin that one connexion sent passwords in clear text (through asipx-webadmin), so they probably were read there. At least it was probably an entry point.

3 and 4 would not take long to be brute forced by a dictionary attack, I think. Too many people use qwerty on their password, so it's probably high rated on a dictionary attack.

3 and 4 are weak because we have pretty good heuristics on how passwords are composed so it wouldn't take much longer to brute-force them than it would to do password123.

I'd be interested to see if either 3 or 4 appear on existing password dictionaries.

This one made me giggle:

> ctsecuritiesfraud@ic.fbi.gov - fraudadmin

I was also quite amused by: 12345678987654321

Reply on news.ycombinator.com