The Top 50 Gawker Media Passwords

http://blogs.wsj.com/digits/2010/12/13/the-top-50-gawker-media-passwords/tab/print/

by m3mb3r • 16 years ago

28 29 16 years ago

blogs.wsj.com

pdx• 16 years ago

I personally use 'password' for my password on sites like Gawker, where I'm being forced to create an account I don't care about. Using 'password' for my password is my note to myself that this is a junk account that I have no interest in. I just don't care if somebody accesses it, period.

I suspect that others do the same thing, and little weight should be given to the strength of passwords recovered from a site such as this.

flawawa2• 16 years ago

Check out http://www.bugmenot.com

sfgfdhgfdshdhhd• 16 years ago

Success.

jpeterson• 16 years ago

The takeaway here? If you want to "hack" into sites like these, you're virtually guaranteed to succeed by picking a few random usernames, and trying some combination of "123456", "password", "12345678", site name, and "qwerty" for password.

I think it's time for someone to come up with a radically better authentication mechanism.

gkoberger• 16 years ago

There were one million passwords released, and only about 3,000 use '123456'. That's only a 0.3% chance.

Yes, you could have a bot that checked the top 50 passwords against a few thousand or so accounts- but even then, you'd only get one or two matches at most.

What if sites blocked passwords that have been used more than twice already? So, at most, there would be two "123456" passwords- any secure password is more than likely something that no more than one other person on any given site would be using.

[Edited: Whoops, did the math too quickly]

BCM43• 16 years ago

There were one million passwords released, and only about 3,000 use '123456'. That's only a 0.003% chance.

Actually, 3000/1000000 = .003, so a .3% chance.

aamar2• 16 years ago

I think good practices around encryption/storage of passwords would make it infeasible to check how many times a password is already in your database.

How about instead just implementing a blacklist of unacceptable passwords?

RickHull2• 16 years ago

> What if sites blocked passwords that have been used more than twice already?

"I'm sorry, another user on this system is already using the password you have submitted. Please choose a different one."

That's not the sort of information you want to be leaking.

jodrellblank2• 16 years ago

How long would you spend in the "another user has this password, please try a different one" loop before getting fed up and leaving?

duck• 16 years ago

...which would allow you to comment on a blog article as someone else. Yikes!

powrtoch• 16 years ago

The list is basically identical to every "most common passwords" leak that's come out since the beginning of the web. Even "monkey", which the author seems to think is quirk of the Gawker community, is known to frequently be a top 20 password.

chc• 16 years ago

Yep. Here's an article from earlier this year that includes it as the 14th most common password: http://www.tomshardware.com/news/imperva-rockyou-most-common...

And here's one from 2008: http://www.whatsmypass.com/the-top-500-worst-passwords-of-al...

Scorpion3• 16 years ago

This lead me to a question about DES. If no salt is provided it uses a static or default two character salt. In the gawker leak, the first two characters of the stored hash were the default salt. How is that two character default derived?

Xk3• 16 years ago

I'm not sure what you mean by 'default salt'.

In the gawker leak, the first two characters of the stored hash were not a default salt, they were random salts. As for how they're generate? Well, randomly.

Scorpion3• 16 years ago

The thing is that they don't appear to be random. Everyone with the same password had the same salt. I guess default isn't the right word. Whatever algorithm they used to generate the salt always generated the same two characters given the same input. I'm curious as to whether anyone knows the details of that function.

ameyamk• 16 years ago

Interesting list. "qwerty" is up there as well. Wondered whats that, and thats just first row on your keyborad.

jodrellblank2• 16 years ago

Also the name of the standard us/uk english keyboard layout: http://en.wikipedia.org/wiki/QWERTY

51Cards• 16 years ago

I am personally surprised by the number of proper names on there. Jennifer, Jordan, Michelle, Micheal. I know these are pretty common names (Jordan?) but when you figure the percentage of the population that would have these names, then the percentage of those that would use their name as a password (assuming they are using their name, and not for some other reason) then it's surprising that so many would make a top 50 list.

dkokelley• 16 years ago

The names are probably picked for other reasons. Each of those names is the name of a popular figure in society (actor, entertainer, sports star).

maukdaddy• 16 years ago

This is actually a pretty good analysis by the mainstream press. While the information is well-known to the point of being common sense for us, for readers of the WSJ it will likely be a learning experience.

DupDetector• 16 years ago

Duplicate:

http://news.ycombinator.com/item?id=2002805

Many comments there.

The Top 50 Gawker Media Passwords

Related Stories