2

I don't understand how it's possible to create a list of the worst passwords used if they're (allegedly) encrypted? Are they collected anonymously before saving in the database especially for this purpose? Or it's just a poll?

5

When LinkedIn was hacked in 2012, nearly 6.5 million password hashes were leaked. Because LinkedIn failed to salt their passwords, it was easy to compute hashes of common English words and combinations, and analyze which were used the most.

I'm not saying this is the only way, but it's one of the possible ways to figure out the "worst used passwords", as you say.

  • Didn't know about that. So leaking unsalted hashes helps to analyze those. And I was talking about something like this or this which seem to appear once per year. – Iulian Onofrei Apr 2 '15 at 9:12
  • In some cases, the breached passwords were stored plain-text, so even easier to collate into large lists. And there are groups that make lists-of-lists of breached passwords: nytimes.com/2014/08/06/technology/… – cybermike Apr 2 '15 at 9:30
  • The reverse of all this, there are now rainbow tables of all these passwords, which of course are only helpful if a breached password hash table is unsalted. And if some site is storing the password hashes salted, but just one non-changing salt value, and the cyber-intruders get the salt value along with hashed password table, it does not take much time to re-hash those billon passwords with the stolen single-salt. – cybermike Apr 2 '15 at 9:34
  • 2
    The Adobe breach in 2013 also "contributed" around 38 million passwords unsalted... eventually you can take all the information from such events and run some statistics on it. The Adobe breach also included hints in clear text... a nice site I like made a puzzle from the passwords and hints – aviv Apr 2 '15 at 10:02
  • @aviv, God :)) What imagination. I'll play with that puzzle soon, looks so amusing and interesting. – Iulian Onofrei Apr 2 '15 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.