When I try to create a virtual machine on Azure, and use the password P@ssw0rd I get an error message saying The password you provided is too common.

Now, from my basic understanding, a provider should be unable to determine the most common password since the hashes will be different even if the password is the same due to salting.

So, how is such a system implemented? I'm assuming Azure is not storing plaintext passwords?

  • 1
    Password database breaches have occurred before. Commonly used ones are known due to this. (Plus, it should be fairly obvious that"password" and variants are common.) – Jonathan Garber Mar 8 '14 at 16:46

One option is to use a list of well known weak passwords. Those lists are available from many breaches of the past in the internet. For example, there RockYou list contains the passwords of more 32 million accounts. One method would be to compare your password with the (let's say) 1000 most common passwords. If there exists one password which is similar to your password then your password is considered to be weak. Similarity can be computed with the edit distance (e.g. Levinshtein distance) which is the minimum number of insertions/deletions/substitutions to transform one string (i.e. in this case the password) into the other one.

Another solution is to use an approach that is described in the paper "Adaptive Password-Strength Meters from Markov Models" (http://blogs.ubc.ca/computersecurity/files/2012/01/06_3.pdf). Here only n-grams of all passwords are stored and counted to create Markov Models from the passwords. These Markov Models are used to compute the strength of passwords. The advantage of this approach is that the Markov Model adapts to the password distribution of the specific site. For example, the RockYou users often tend to use passwords which contain the string "rockyou" in some form. Therefore, for RockYou this passwords similar to this one should considered to be weak. For other web sites there are other site specific weak passwords.

| improve this answer | |
  • Using a static list does seem to have a major pitfall of not being updated frequently due to newly popular passwords ( xkcd.com/936 ) – Akash Mar 10 '14 at 18:51

They are not saying it is too common within Azure, that would indeed make their security questionable.

They just say it is too common. On the internet you can find lists of often used passwords (perhaps leaked by insecure websites in the past) and they probably use one of those lists.

| improve this answer | |

They simply run your plaintext password through a common password search db or algorithm before hashing and saving.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.