How I Collect Passwords

http://xato.net/passwords/how-i-collect-passwords

by wglb • 14 years ago

177 123 14 years ago

It is fascinating how many passwords are available ... I wonder why websites don't stop one from using these common passwords during account setup?

rrreese• 14 years ago

I suspect that any sort of password enforcement would decrease sign ups in relation to its strictness. It would be an interesting thing to AB test.

wglb• 14 years ago

Some do, with rules about complexity: minimum length, mixture of different classes of characters (lower, upper, numeric, special). Beyond that, I am not aware of websites looking through something like his considerable list of passwords to rule out choices.

TazeTSchnitzel• 14 years ago

Twitter does. They banned (IIRC) the 123 most common passwords. They have a list, too.

chrisacky• 14 years ago

Because it's intrusive. There are lots of opinions on how far a website should go to ensure their users select strong passwords, but I implement a strawman password roster.

If some of the throwaway sites and forums that I sign up to once started forcing me to select a more secure password it would be extremely annoying and I wouldn't sign up.

I'm perfectly happy with my 6 letter a-z password for one time forums, that I use anonymously, and that I might occassionally log back into twice.

Incidentally, the password I use is "openit". This password means nothing to me. If you did some detective work on me I'm 100% sure that you would be able to get access to some sites that I use by entering that password.

Not having to use symbols, capitals, and strong passwords for these throwaway sites, means that I can effectively maintain about 10 different password sets, where my most important "tier 1" passwords are reserved for my SSH keys and email.

pavel_lishin2• 14 years ago

I'd be curious how many 'throwaway' passwords are "sesame".

patio112• 14 years ago

cough $250 in sales from folks who chose "password" in 2011. I suppose I could tell them "Wait wait, put your credit card back for a second and listen to a complicated instruction designed to solve a problem you don't have.". Doesn't seem to be a huge upside, though.

trin_• 14 years ago

and you know that because:

a) you store cleartext passwords b) you use a static salt and have memorized the hash of the password+your salt ... or c) ???

mkjones9• 14 years ago

Facebook does - we have a blacklist of common passwords, and you cannot register an account with them or change your password to them.

That being said, I think with sufficient protections against brute forcing, password complexity requirements are largely a waste of time. The percent of users' accounts you can get into with the number of attempts allowed before locking you out is so small that it's not cost-effective, and the majority of people trying to break into accounts are doing so at scale for financial gain.

m8urn9• 14 years ago

Has Facebook ever shared that list?

eli• 14 years ago

occasionally I will spend half a day leeching from these forums

Man, I'm glad that's not my job

pavel_lishin2• 14 years ago

Seems like it would be easily automatable with Greasemonkey, or dotjs.

chris_wot9• 14 years ago

I have to say that I loved his other post on the TSA's ridiculous password policy...

http://xato.net/passwords/worst-password-policy-ever

Their policy is:

1. Minimum password length is eight characters.

2. Passwords must contain at least one of each of the following: one alphabetic uppercase, one alphabetic lowercase, one numeric, and one special character.

3. Passwords shall not contain any two identical consecutive characters (example: 22apples, 14588904).

4. Passwords may contain no more than two identical consecutive characters in any position from the previous password.

5. Passwords shall not contain any dictionary word.

6. Passwords shall not contain any proper noun or the name of any person, pet, child, or fictional character.

7. Passwords shall not contain any employee serial number, Social Security number, birth date, phone number, or any information that could be readily guessed about the creator of the password.

8. Passwords shall not contain any simple pattern of letters or numbers, such as "qwerty" or "xyz123".

9. Passwords shall not be any word, noun, or name spelled backwards or appended with a single digit or with a two-digit "year" string, such as 98xyz123.

10. Pass phrases, if used in addition to or instead of passwords, should follow these same guidelines.

11. Passwords shall not be the same as the User

12. Password length will be selected to provide a level of protection commensurate to the value or sensitivity of the resources or data it protects, but not less than eight characters.

You just can't make this stuff up!

13rules• 14 years ago

Wow ... their online security rivals their airport security!!

chris_wot9• 14 years ago

With all these restrictions, I wonder how far they are reducing the possible key space? Some of these suggestions actually remove a number of permutations - like for instance you can't put in two digit years - this must remove a HUGE number of combinations!

Then you remove ALL the dictionary words, all proper names, all the TSAs serial numbers, all reversed words - well, that's gotta make cracking an 8 letter password easier :-)

m8urn9• 14 years ago

Yep, they won't even let you use "fingernail clippers" as a password.

DanBC4• 14 years ago

What, precisely, is bad about that list?

There's a problem that people when faced with a dialogue box asking them for a password will be unable to think of a strong password, but that's solved by giving them some form of auto generation.

Writing passwords down is not a security problem, if the slip of paper is kept safely.

chris_wot9• 14 years ago

The link I provided gave some pretty good reasons, I thought.

quadhome2• 14 years ago

The linked article addresses what, precisely, is bad about that list on a point by point basis. It's good reading!

Most web browsers now have built-in password managers. Here's to hoping that loop is soon closed with password generation!

Tangurena2• 14 years ago

Because when it comes to changing passwords, it would take me about 45 minutes to come up with a new password that met the rules and had a reasonable chance of me remembering it. I took to writing them down as I was trying to come up with something, and keeping the paper handy for a few days because I'd frequently forget the passwords by lunchtime and lock myself out of the system.

One thing to remember about these rules is that there are some other ones not publicized. All you know when it refuses to take your password is that it says "password doesn't match" instead of "password doesn't meet the rules." I got some different error message when I tried using Russian obscenities, but I forget that error message.

m8urn9• 14 years ago

If nothing else, the list itself is long and intimidating.

billybob4• 14 years ago

My favorite bit: "Passwords may contain no more than two identical consecutive characters in any position from the previous password".

How would they know that unless they have your previous password in plaintext?

Security Fail

chris_wot9• 14 years ago

Not to mention they know the names of your pets :-)

NLips3• 14 years ago

They could store a hash of your old password, along with 40 hashes, one for each character, hashed against the hash of the old password. e.g.

'this_is_my_password" => hash1 'hash1_t' => hash2 'hash1_h' => hash3 etc

This way, when you enter the first character of a new password, they can hash it against your old password, see if it creates hash2 and refuse permission to use the new password. Hopefully this is the same way as websites can ask for only selected characters from a password when you log in.

kristianc• 14 years ago

Should we also be worried then about Facebook, which also stores previous passwords?

_ea1k2• 14 years ago

That requirement actually isn't as rigorous (or as difficult to implement) as it sounds. The keyword there is "password" instead of passwords. Based upon similar systems, I feel comfortable that this is not a typo.

Whenever the user changes a password, the user has to provide a (single) previous password. This password is hash-checked against the current user password. Then the password duplication rules are applied.

(Note, none of the above should be construed as an indication that I agree with this approach to password policy :) )

kahawe2• 14 years ago

Don't be so quick to judge.

Believe it or not, it is not so uncommon for LargeCorps to store passwords in a way they can be retrieved again at least in one place - which is usually their central identity management system. This helps them enforce password policies and expirations across a wide range of systems and gives them better control and overview of all the many user accounts lurking around on all their systems. And obviously being able to make sure all accounts of a user are properly locked or deleted is more important to them than giggling at centrally storing potentially tens of thousands of passwords.

The system I know and maintain stores your current password and history in an encrypted form and protects them through various means, so if you got a full DB dump you would still have to brute-force. Works pretty well for us and the advantages seem to greatly outweigh this downside of having passwords stored somewhere in a retrievable form. Plus in typical LargeCorp you have (more or less) sophisticated logging and monitoring tools on top of that so a lot of suspicious activities are detected pretty well. And there are a LOT of other LargeCorps I know of which are using that same product and on a global scale.

So, such a system is definitely overkill in ye-old startup webshop, if only for the insane bucks it costs, but for LargeCorps with way too many systems piling up it can be very valuable.

Tangurena2• 14 years ago

This looks exactly like the Dept of Energy password guidlines when I worked there.

For item #5, you should be aware that they check for dictionary words of 3 or more letters, both forwards and backwards. I'm not sure what dictionaries they were using, but I found that most of the Japanese, Russian and Finnish words/phrases that I frequently pick from were forbidden.

kibwen2• 14 years ago

5. Passwords shall not contain any dictionary word.

Bear with me as I close my eyes and hammer wantonly on my keyboard:

kjhjks;dfijwefasdkfj

Aha! First try, and I've already generated an insecure password containing five dictionary words. Until vowels are banned as well, I fear our national security is in peril.

civilian2• 14 years ago

did you actually check this against the unix dictionary? I only found: ['as', 'fa', 'fi', 'we']

kahawe2• 14 years ago

> My first thought here is that if you are going to have such an extreme password policy, you could at least set the minimum password length to ten or even twelve characters

Well, and then in reality you have a couple of those old 40 ton host systems lurking in the basement and all its former tamers are long gone, everyone is just glad it is still running and somehow it only allows exactly 8-char passwords with characters and digits only... and somehow it still is one of the most fundamental systems of what you are doing on a day-to-day basis so if you are introducing a central password policy and maybe even a central identity management (which I assume those huge departments are using) then you have to make the bitter decision of accommodating for the "old timer" systems as well or leaving out the proverbial 20% of your systems that see 80% use each day...

JoshMock• 14 years ago

+1 for using KeePass, 1Password, etc.

HorizonXP2• 14 years ago

I use Revelation on Ubuntu. It hasn't been maintained in quite some time though, I should pick up the code base and update it.

thereallurch• 14 years ago

Surprised no one has mentioned OpLop for passwords. I keep a list of sites (containing a site nickname and a password hint). I then wrote a simple md5base64 perl script which combines the nickname and password (similar to OpLop..basically md5(nickname+pass)). Script throws the result on to my clipboard, and I hit paste. Thus, no two sites use the same password. If one site is compromised (ex: zappos.com), I just need to change that one password. Script is on my phone, desktop, and cloud drive.

I use multiple passwords, a different one based off the importance of the site. I was amazed at how many sites impose a 12 character limit (Fidelity...really?).

acheron• 14 years ago

Yeah, I was annoyed by the 12-character limit at Fidelity too. They also prevent punctuation and other characters.

I think the problem is that they unify the website password with a password you can enter on the phone if you call them. I guess that makes it easier to remember for a customer so that they don't have two separate passwords, but touch tone-enterable passwords have completely different requirements from Internet passwords, so think it would be better to decouple them.

Groxx• 14 years ago

My personal favorites are the ones that silently truncate your password. A few have done this to me, and it used to take a while to realize wtf was wrong when I couldn't sign in right after creating an account. Now I just start shortening the password until it works, which 'fixes' a good 99% of just-signed-up login failures.

rch• 14 years ago

>> "None of the passwords contain a colon, because that is the delimiter used to separate usernames and passwords in the combo lists my scripts generate."

tldr; Put colons in your passwords...

VikingCoder2• 14 years ago

>> "My scripts only grab usernames and passwords between 3 and 30 characters long, all others are thrown out."

tldr; Put colons in your passwords, and make sure your password is 31 characters long.

I bet it would also make sense to include "username:" in your password.

For instance:

username: VikingCoder

password: username:CorrectHorseBatteryStaple

Or how about like this:

username: VikingCoder

password: '); DROP TABLE Passwords;

xanadohnt• 14 years ago

That's some dedication to Bobby Tables just one person. ;)

chimeracoder2• 14 years ago

The problem is that you may also erase the entire database of the server you're trying to log into: http://xkcd.com/327/

I guess that's one way of protecting your accounts from being hacked, though... you can't hack an account that no longer exists!

gvb• 14 years ago

That only works for his database of username:password combinations due to how he stores them. It won't protect you from someone else's database of password combinations.

Since he collects only publicly available username/password combinations, you're already screwed and avoiding his list is slamming the door after the horse is gone.

m8urn9• 14 years ago

Thanks for pointing that out, my list comes from public sources.

mjwalshe3• 14 years ago

So you admit to a number of rather dubious practices both on an openly avaible blog and on a forum that has at least one EX NSA employee as a poster.

Anyone else think this is ill advised to say the least - its just asking for your phones to work realy well "nudge nudge wink" ;-)

zevyoura• 14 years ago

What's dubious? I don't think there are many (any?) people who understand what he's talking about and would be able to implement it, but wouldn't be able to figure it out on their own. Of that set, the set of people who are malicious is even smaller, if not non-existent.

mjwalshe3• 14 years ago

"I visit a number of public and private hacking-related forums to get wordlists and hacked passwords. I often pay for VIP memberships (usually the lifetime ones) so that I can access premium content areas. "

and when the men with no sense of humor invite you for an interview with out tea and biscuits what would you say to that.

ok the are grey areas and I have on behalf of a FST100 organization broken in to a system with explicit permission and clearance from v senior manger and I also had far better contacts at BT's board level to lobby in case or security dept threw a hissy fit than most people

learc83• 14 years ago

What if China is using their well known hacker resources to secretly build a giant list of username password combos like this guy, but on a massive scale.

They could use botnets to log in to hundreds of thousands of bank accounts and transfer money. There wouldn't be an easy way to detect them because they'd look like legitimate transactions, and the only option would be to temporarily shut down online banking transactions.

I wonder how much of a disruption they could cause?

3pt14159• 14 years ago

Targeted stikes, yeah, it can work. Massive downloading of gmail account passwords, NOPE. It will set off internal alarms. But yeah, to target one individual, it is indeed possible and they did a string of those when they cracked the rotating RSA key.

mkjones9• 14 years ago

Do you have a reference for people doing an online brute force attack in the RSA attack? IIRC the only brute forcing they did was offline (i.e. cracking hashes that they had locally).

Or maybe that's what you were saying, and I'm just misunderstanding you :).

mgkimsal• 14 years ago

IMAGE: http://michaelkimsal.com/blog/wp-content/uploads/2011/06/Scr...

"Passwords should not have more than 9 characters".

This from a financial institution.

primaryobjects• 14 years ago

Unfortunately, many banking web sites require short passwords with no special characters. Likely, due to legacy databases and storage. I've even seen 6 character max restrictions. Or worse, the 4-digit pin ones (10,000 combinations yikes, I sure hope they have a limit and lockout for incorrect guesses).

ch0wn2• 14 years ago

My bank upgraded from a 4-digit pin code authentication to a 6-letter ([a-zA-Z0-9]{4,6}) system. About legacy databases ...

Naturally, I complained and they told me it wasn't that big of a deal, because the actual transactions were protected by TAN generators. I had no answer to that.

evoxed• 14 years ago

Oh god, PIN codes... Two years ago my girlfriend and I had to go to our banks and get cash. Luckily they're right across the street from each other, so we walk in to mine first. I go to the ATM, tap in my pin, do my thing and we move across the street. I'm standing by the door while my girlfriend goes to the machine. I'm still fiddling with the receipts in my pocket and whatever when I hear something. The ATM, plastered in signs to cover your screen, not let anyone see you putting in your pin, etc.– was calling the tones on the speaker. Anyone who cared to listen could hear her pin. I've yet to encounter another machine that does that, but man– if I ever got a hold of the who decided that a 4-digit pin was a good idea for security there would be quite an unpleasant exchange...

lytfyre• 14 years ago

My bank requires 8 to 10 characters, [a-z]|[A-Z]|[0-9] only. They also require you to know something easily researched from facebook (elementary school, mother's maiden name, etc.) when you use a new machine.

That they refer to this as two factor authentication makes me question their ability to do simple addition, something I consider a fairly important skill for a bank.

jackpirate• 14 years ago

something I consider a fairly important skill for a bank

but not important enough to switch apparently

edoloughlin• 14 years ago

> They also require you to know something easily researched from facebook (elementary school, mother's maiden name, etc.)

I'll never understand why someone would provide this information to Facebook. My friends already know the details of my life relevant to our relationship.

dgordon• 14 years ago

Not that it excuses this so-called security, but for the insecurity question, you could just lie. Only problem is, then you have to remember your lies.

dredmorbius2• 14 years ago

That was another point I meant to raise. Even if your password policy and weak-password checks are sane, if your account recovery procedure is weak, there are still planet-sized holes in your security perimeter.

And for any large system (say, Facebook, with, oh, nearly a billion accounts), user support requests (many of which are access related) are a huge cost. It doesn't take many of these to eat through $2-$5/account/year value they're seeing.

mrb• 14 years ago

Try Wells Fargo/Verified by Visa: http://blog.zorinaq.com/?e=54 Passwords cannot be longer than 8 characters. WTF!

As if they were using UNIX crypt()...

stephengillie• 14 years ago

Does anyone else get the "Access Restricted: you're botnet infected" page?

Running virus scan... sigh

m8urn9• 14 years ago

That is due to the cloudflare service. You can actually leave a note, I do follow up on those.

Edit: It's a good thing I'm using that too, 108K hits from this in the last four hours. CloudFlare saved my site from 800k requests and 6GB in bandwidth.

jwallaceparker• 14 years ago

I've been using 1Password for the past few months.

It's been incredibly useful. All my passwords are exponentially more secure and synced across my devices.

Can't recommend it enough.

SCdF• 14 years ago

Additionally, if you want linux support and don't care so much about the web support that 1Password gives you (your password file is also a website that uses JS to decrypt your passwords) or the prettiness and would like to save US$60 KeePassX works perfectly well.

K2h• 14 years ago

Thank you for sharing the various methods you use to collect the passwords. That is extremely detailed.

I was curious if you ever considered putting a date stamp on the log for when you found a particular password. Because you have been collecting for such a long time, you may see some interesting trending.

m8urn9• 14 years ago

I have actually kept most of the original data since I started so I could go back and do that if I wanted. There is about 4gb of raw data there.

HorizonXP2• 14 years ago

http://xkcd.com/936/

I personally believe that a great startup idea is a website or app that operates like KeePass or 1Password or Revelation, and allows you to enter your passphrase like xkcd suggests, and manages all of your other passwords and logins for you. I'm guilty of using the same password for a lot of sites, and I really need to get that in order. Making it easy for regular users to adopt would be key. It's an idea, I have no idea how you'd execute it.

That said, I'm developing a web-based management interface for my contract work that is only going to be used by a few key users/stakeholders. I'm trying to come up with a way incorporate xkcd passphrases into it, forcing my users to adopt it. I don't know how well it would go over though. Guess I just have to try it and see.

wingspan• 14 years ago

Isn't this what http://lastpass.com does?

billybob4• 14 years ago

A sensible password-selection policy really only has two principles:

1. It shouldn't be in a dictionary, so that the only option is brute force 2. It should be very hard to brute force

#1 means "don't use anything in this guy's list."

For #2, the concept of "password haystacks" is useful:

https://www.grc.com/haystack.htm

DanBC4• 14 years ago

Steve Gibson is not considered expert:

(http://radsoft.net/rants/20010714,00.shtml)

(http://www.groklaw.net/article.php?story=20060113111825193)

(http://attrition.org/errata/charlatan/steve_gibson/)

etc etc.

billybob4• 14 years ago

Is there something specifically wrong with the concept of password haystacks? I understand it as "force the attacker to search an extremely large potential keyspace." The tool I linked to simply calculates the keyspace that a given candidate password is in.

dredmorbius2• 14 years ago

Compiling/sharing a list like this, so that it can be used in password strength checkers, would be a strong plus.

The best password is one that's never been used before. Rainbow tables and other methods mean that any known password (and in a list of exhaustively compiled passwords, finding only 1.3 million distinct values is "small") can be found very quickly given access to hashes, or tried relatively quickly via brute-force. Even a series of login attempts to known / common account names with top-50 (or some n) passwords will generate many hits.

I'd love to see online sites check against known lists. I've suggested it to several. One problem is coming up with a good "known list".

It would be even more useful for this to be added to standard OS/system security features.

zupreme• 14 years ago

With our TeddyPass app we are pretty loose on what users can use as their login password, but we employ pretty robust techniques to prevent brute-force attacks and other common methods. With our system key user data (like stored usernames, passwords, and the description of the account entry) is fully encrypted based on the user's password and other factors. As a result we can't retrieve their data even if we wanted to, so it's in our best interests to allow people to use just about any password they can comfortably remember (within reason).

pbhjpbhj2• 14 years ago

Anyone else worried that Athena (http://www.project2025.com/athena.php, link in article is messed up) is actually going to start by installing a keylogger or uploading password files from ones own computer ...

Paranoid? F'sure!

m8urn9• 14 years ago

How do you know I don't already have your password anyway?

pbhjpbhj2• 14 years ago

Was that you I saw crouching in my fridge earlier?

is74• 14 years ago

I thought openID would solve the password problem, because it would allow for each person to remember one password only (which is still better than password1234). What reasons prevented the widespread adoption of openID? For example, if I were a startup, I'd want to have openID on my site to make it easier for users to register, and help them to not forget their passwords. Yet for some reason there are few sites that support it. Any thoughts?

mkopinsky2• 14 years ago

My goto IRC password is hunter2.

How I Collect Passwords

Related Stories