2

I don't understand how it's possible to create a list of the worst passwords used if they're (allegedly) encrypted? Are they collected anonymously before saving in the database especially for this purpose? Or it's just a poll?

1 Answer 1

5

When LinkedIn was hacked in 2012, nearly 6.5 million password hashes were leaked. Because LinkedIn failed to salt their passwords, it was easy to compute hashes of common English words and combinations, and analyze which were used the most.

I'm not saying this is the only way, but it's one of the possible ways to figure out the "worst used passwords", as you say.

5
  • Didn't know about that. So leaking unsalted hashes helps to analyze those. And I was talking about something like this or this which seem to appear once per year. Commented Apr 2, 2015 at 9:12
  • In some cases, the breached passwords were stored plain-text, so even easier to collate into large lists. And there are groups that make lists-of-lists of breached passwords: nytimes.com/2014/08/06/technology/…
    – cybermike
    Commented Apr 2, 2015 at 9:30
  • The reverse of all this, there are now rainbow tables of all these passwords, which of course are only helpful if a breached password hash table is unsalted. And if some site is storing the password hashes salted, but just one non-changing salt value, and the cyber-intruders get the salt value along with hashed password table, it does not take much time to re-hash those billon passwords with the stolen single-salt.
    – cybermike
    Commented Apr 2, 2015 at 9:34
  • 2
    The Adobe breach in 2013 also "contributed" around 38 million passwords unsalted... eventually you can take all the information from such events and run some statistics on it. The Adobe breach also included hints in clear text... a nice site I like made a puzzle from the passwords and hints
    – aviv
    Commented Apr 2, 2015 at 10:02
  • @aviv, God :)) What imagination. I'll play with that puzzle soon, looks so amusing and interesting. Commented Apr 2, 2015 at 13:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .