I have written a script to check a given password against a ~65 million long list of passwords collated from various lists released after hacking attempts.

I am thinking about incorporating it into the password checking process when a user chooses a password - notifying them that a password is on a list used by hackers.

Plus I wondered if it could be used to detect a dictionary/ brute force attack when passwords in the list are ysed in failed login attempts.

Any thoughts on the usefulness/ effectiveness of this approach appreciated.


If you are concerned about them using weak passwords, I would just focus on the complexity requirements. Force them to use a 12+ character password with special characters. A list of 65 million sounds to be relatively small, are these mostly less than 8 characters?

In consideration of a brute force attack, it doesn't matter if there is great entropy or distribution among the characterset if the length is low (8 or less characters).

You get the same bang for you buck if you just enforce client side length and complexity or "password strength checker". Probably better to put your effort into securing the storage of the password on the backend (salt, pepper, hsm, etc.) so it can't be compromised.

From the brute force perspective. If the attacker steals your DB and does an offline attack, clearly your check if not going to be of any consquence. If they are trying to do an online brute force, you can just lock the IP out after X number of failed attempts or to lock out the account if its being targeted with multiple attempts in a distributed matter and let the user reset when they want to legitimately get on. It sounds like it would be much more complex and require more resources to check against the list on each attempt to logon - possibly could lead to a denial of service on a modest web server by over taxing the system.

While it can have some value, I am not sure if users would get it. While its nice to want to try to protect them, if they want to use short passwords and you let them, they will - maybe they take their five character password and add a number - if this isn't on your list, its done nothing to help them since it's a still only six characters. So your list will detect some common passwords, but it doesn't address the core issue which is length and complexity. Trying 65 million passwords in an offline attack is no effort for an attacker with a GPU cracking rig.

  • Thanks Eric G. I think we are getting somewhere with this. A few points: – theHands Mar 24 '14 at 2:27
  • I'm not suggesting this as a replacement for other password restrictions/ security measures. When someone is choosing a password, it is more a case ofeducating the user. Twitter sign up page stops you from using an 'obvious password' however I think this is through a short list in javascript. – theHands Mar 24 '14 at 2:33
  • Yes the list does include many short passwords. It could be improved by only including those of a length equal or more to the minimum password length. – theHands Mar 24 '14 at 2:36
  • I take your point about passsword length being most critical to resistence against brute forcing. However, wouldn't an offline brute forcing attempt start with password lists? If no passwords used could be on those lists, aren't you making it take longer to brute force every password? – theHands Mar 24 '14 at 2:42
  • A distributed dictionary attack on a live site (like those on wordpress) surely would start with password lists? If you detect that failed login attempts are using these lists, wouldn't this be a very good indicator of a brute force attack - even one distributed over a large ip range and over a long period? – theHands Mar 24 '14 at 2:51

A good security strategy is generally simple and elegant, just like Mathematics. There are established methods for checking the safety of a password. Checking a password against millions of possible words seems a bit intensive and overly complex. Plus, you also may be in risk of a new brute-force attack against your script via resource depletion, since it requires quite some CPU cycles to check a password against millions of entries.

  • This is not intended as a replacement for checking the entropy of a password and the list is split into indexed files for faster searching – theHands Mar 23 '14 at 12:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.