Among the more security savvy community (very much including security.stackexchange) there is an ongoing discussion about the strength of different password policies. Examples include the Tr0ub4d0r&3 vs correct horse battery staple, Bruce Schneiers scheme, the BBC scheme, among others.

These different approaches have all been examined in-depth, down to entropy-level calculations, how easy certain passwords are to remember, etc. -- and I think we can all agree on the qualities good passwords need.

Also, we all know the stories of password, love, 123456, querty and all the other useless phrases that the average Joe sometimes relies upon and that appear every time a large collection of passwords gets leaked somewhere.

But have there actually been known cases where people invested some thought/effort in picking passwords which in hindsight proved to be too weak? I sometimes get the feel that if an organization/person is aware of the password issue, and has even a basic understanding of security principles, they are already 99.9% safe on that front.

To reformulate the question:

How often has password strength been an actual security problem in a professional context?

With 'professional context' I explicitly mean a context where some informed decision was undertaken to choose decent passwords.

E.g. somebody picked a non-trivial password (maybe Tr0ub4d0r&3-style), and it was actually cracked and exploited in a context where a different scheme would have proven more resilient (and where the reason for the incident was not some other failing part of the security chain).

  • 1
    "I think we can all agree on the qualities good passwords need." not even close :D I personally think most research on the topic is deeply, deeply bogus. The strength of an individual password from an individual user means absolutely nothing in 2016. Commented Jan 26, 2016 at 13:02
  • 1
    This is what I meant, really. Is it actually worth our time to still be discussing password policies when an exploit/backdoor/phishing/social engineering/... attack is so much more likely...
    – fgysin
    Commented Jan 26, 2016 at 13:38
  • 1
    I think another way to answer your question is to look at what has been found in public password dumps, specifically cases where the passwords were hashed and a large percentage were cracked. For example we do sometimes see different password techniques showing up in those large sets of "cracked passwords" which would imply that the users did attempt to do something beyond the basic level of passwords. I think the fact that these too occasionally get cracked means that teaching better password development techniques is in fact still relevant. Commented Jan 26, 2016 at 15:18
  • 1
    Why the votes for close? Can someone suggest edit that would make this question more eligible? (I'm really asking for specific real world occurrences of failure of decent password policies - this seems answerable to me, if not necessarily obvious.)
    – fgysin
    Commented Jan 26, 2016 at 15:18
  • 1
    Hey @fgysin this paper may not answer the part of your question about a weakly created password actually being exploited but it does provide insight on what password strengthening measures average people take that may not provide much security benefit.
    – PwdRsch
    Commented Jan 26, 2016 at 17:29


Browse other questions tagged .