I Am Releasing Ten Million Passwords

https://xato.net/passwords/ten-million-passwords/

by m8urn • 11 years ago

594 216 11 years ago

tptacek11• 11 years ago

Barrett Brown was not convicted merely for linking to data on the web. He was convicted for three separate offenses:

1. Acting as a go-between for (presumably Jeremy Hammond) the Stratfor hacker and Stratfor itself, Brown misled Stratfor in order to throw the scent off Hammond. Having intimate knowledge of a crime doesn't make one automatically liable for that crime, but does put them in a precarious legal position if they do anything to assist the perpetrators.

2. During the execution of a search warrant, Brown helped hide a laptop. Early in the trial, in advancing the legal theory that hiding evidence is permissible so long as that evidence remains theoretically findable in the scope of the search warrant, Brown admitted to doing exactly that, and that's a crime for the same reason that it's a crime when big companies delete email after being subpoenaed.

3. Brown threatened a named FBI agent and that agent's children on Twitter and in Youtube videos.

The offense tied to Brown's "linking" was dismissed.

Brown's sentence was unjust, but it wasn't unjust because he was wrongly convicted by a trigger-happy DOJ; rather, he got an outlandish sentence because he managed to stipulate a huge dollar figure for the economic damage caused by the Stratfor hack, which he became a party to when he helped Hammond.

sarciszewski4• 11 years ago

Barrett Brown was not convicted merely for linking to data on the web.

From the article:

     Most of us expected that those charges would be dropped and some were, although they still influenced his sentence.

I want to be generous and say that the author meant what you said. The linking was not something Brown was charged with, but it was brought up during the sentencing and probably influenced the length of his prison sentence.

So while you're correct that Brown was not charged with linking to information, it's worth noting that this was still used against him anyway.

Also, people who think the linking to hacked data was the only thing that got him arrested are being disingenuous (or are simply ignorant).

tptacek11• 11 years ago

I'm not seeing where the linking was used to enhance his accessory conviction. Is there a source for that?

m8urn9• 11 years ago

The trafficking charges were dropped but he still was charged as an accessory after the fact. http://cryptome.org/2015/01/brown-105.pdf

tptacek11• 11 years ago

Yes; that's #1 in my list. Thanks for the link to the sentencing memo!

egocodedinsol• 11 years ago

but what do you think about the big picture?

I don't know much of the specifics about Brown, but I think the wider point is worth discussing, especially with respect to the proposed change in legislation.

Slartibreakfast• 11 years ago

I don't know, sounds like he got off pretty lightly considering he threatened an FBI agent's children. I would expect the jail time would be a lot higher, but I guess I don't know what guides the court's decisions in these kinds of cases. I suppose five is enough time for him to figure out the error of his ways.

tptacek11• 11 years ago

His sentence was dominated by the accessory charge, and the threats don't seem to have been a factor at all.

jbapple5• 11 years ago

What were the threats against the agent and the agent's children? I'm asking because I read some of them ("ruin his life", "look into" his kids), but I'm not sure which of those are protected under the First Amendment.

Broad categories of rude speech are protected under the First Amendment, including things like, IIRC:

1. Saying if President Johnson makes you pick up a gun, he'll be the first in your rifle sight. (Watts v. United States)

2. Telling a cop "I'll kill you, you white devil" while you are in handcuffs and unable to kill him. (? v. ?)

3. Swearing "revengeance" upon the Jews. (Brandenburg v. Ohio)

jbapple5• 11 years ago

It was "White son of a bitch, I'll kill you", and it was Gooding v. Wilson.

higherpurpose• 11 years ago

It's interesting that you say his sentence was "unjust" given that you always seem to defend crazy sentences as "not being the real ones anyway".

Also those three sound like incredibly weak charges, and yet you somehow defend the prosecution over them.

tptacek11• 11 years ago

Is it because I say his sentence was unjust given that me always seem to defend crazy sentences as not being the real ones anyway that you came to me?

Earlier you said I say his sentence was unjust given that me always seem to defend crazy sentences as not being the real ones anyway?

Maybe your life has something to do with this.

downandout4• 11 years ago

The offense tied to Brown's "linking" was dismissed

This masks the scary reality that someone was indicted, arrested, and prosecuted for posting a link (not to mention that it was dismissed as part of a plea - not for lack of legal merit). While in this case there were other charges as well, there didn't have to be - all of the same pre-trial horrors (including possible detention without bail) could have occurred with only that charge. The fact that such a charge may eventually be dismissed/beaten at trial after your life is burnt to the ground for posting a link is little comfort.

tptacek11• 11 years ago

That's also a misleading way of framing the issue. Brown wasn't charged with "criminal linking" (an offense that does not exist). He was charged with deliberately and knowingly assisting in the breach of Stratfor, and subsequent maximization of the damage from that breach. And remember, he was convicted of doing that; they just pursued a different vector for it than the link. Keep in mind also, they didn't just work back from people who posted links. Hector Monsegur ratted Brown out.

Most criminal statutes look insane if you ignore the mens rea component and consider only the actus reus.

Probably the right way to address your comment is to acknowledge the sentiment behind it. It would be ominous if prosecutors trawled the Internet looking for the wrong kinds of links --- people RT'ing updates from Anonymous, for instance, or relaying already-public newsworthy facts from breaches --- and fit accessory liability cases around those innocuous acts. It is worth being wary about prosecutors doing that, because computer crime laws are poorly rigged and set up terrible incentive systems for prosecutors.

It's just that those concerns are not yet vindicated by the Brown case.

pdabbadabba3• 11 years ago

This assumes, though, that he would have been put through everything you describe even if he had only shared a link. But, as described in detail above, this was only a small piece of the government's case. I seriously doubt the government would ever have brought charges if all it had was the posting of a link.

We should also think a little bit harder, I think, about whether posting a link is never criminal. It seems to me that if someone posts a link to intentionally further a criminal conspiracy, it seems like it could plainly, and unproblematically be criminal. Accomplice liability in particular makes lots of other things, that would otherwise be innocent, into crimes when they are done with the wrong sort of intent.

camhenlin• 11 years ago

Man, I hope my password isn't in there.

untog• 11 years ago

Read the actual article. None of this data is new:

All data currently is or was at one time generally available to anyone and discoverable via search engines in a plaintext

chisleu• 11 years ago

I'm not!

#successkid

m8urn9• 11 years ago

Actually three of my own passwords are on there, I left them in

aceperry• 11 years ago

My thoughts exactly. I'm amazed that I can download the file, but at least I get to see if any of my passwords are there.

cwarrior• 11 years ago

What's your password? I could check the file to see if it's there. I found one of mine. Does anybody know from where these passwords are from?

m8urn9• 11 years ago

Public dumps mostly from the last 5 years, but some as old as ten years

stephentmcm• 11 years ago

hunter2

totony5• 11 years ago

What's your password?

20kleagues• 11 years ago

Way to go buddy! This research is indeed necessary and releasing such a dataset will be beneficial. Maybe it will also bring light to how outdated password based authentication really is.

julianpye• 11 years ago

Everyone knows the whole email/password concept is broken. I believe that overall OAUTH is needed, but it needs a much stronger consumer facing view.

sarciszewski4• 11 years ago

A well-implemented OAuth implementation is wonderful. Sadly, many implementations are just crappy.

throwawaykf052• 11 years ago

What's worse than crappy implementations is that every provider has their own version of implementation-specific crappiness that is inconsistent with everyone else's.

StavrosK2• 11 years ago

I'm not sure how OAuth can help. Does it allow you to choose whom to authenticate with, or does it tie you to one specific provider? I much prefer Persona, but Mozilla has abandoned it, and most resources around it are dead links. What a colossal shame.

sarciszewski4• 11 years ago

I'm personally looking forward to something like SQRL.

https://www.grc.com/sqrl/sqrl.htm

sarciszewski4• 11 years ago

He was close to Anonymous and was in fact their spokesman.

Err, no he wasn't. He just managed to get a modest amount of attention.

charlespwd• 11 years ago

For the lazy:

  grep -i <password> 10-million-combos.txt

flavor8• 11 years ago

And then history -c

vacri2• 11 years ago

... which will clear your entire history, which you probably don't want.

I don't know a shorter way, but to delete one line from history, do 'history', which shows the line numbers, then 'history -d LINE_NUM'.

Or, in bash, prepend the command with a space and it won't go into history.

fletchowns• 11 years ago

Unless somebody did a ps while your grep was running...

Don't put sensitive stuff in CLI args!

brianshaler• 11 years ago

Depending on your system and configuration, couldn't you prepend a space to the command to prevent it from being saved into your history?

edit: Looks like vacri mentioned this in a peer comment an hour ago. Whoops!

tarblog• 11 years ago

For the lazier, -i means case insensitive.

me_bx• 11 years ago

for the paranoïd lazy

    export HISTCONTROL=ignorespace
     grep -i <password> 10-million-combos.txt

(type a space before the command for it not to be logged in the history)

pavel_lishin2• 11 years ago

Just because you're paranoid doesn't mean the eyes above your ï aren't watching. Although, it might mean you're delusional.

stevecalifornia• 11 years ago

When I first got on the Internet in 1994 I used the same password for everything for the next decade before I became security conscious (now I have a random, strong, unique password for every service).

Anyways, that password is not in this list. I have found it in other password dumps before. So, I don't know what to think.

6t6t6• 11 years ago

I don't think it is necessary to have one password for every single system, but three or fours tiers of passwords.

And just keep in mind that there's one password to "rule them all". That is the password for the primary mail account. I use 2-factor authentication for that.

scintill76• 11 years ago

three or fours tiers of passwords

Can you elaborate? My first thought is tiered by category of the service. No, I don't want my financial institutions to all have the same password, even if it's from the most secure tier.

nostromo• 11 years ago

This isn't a comprehensive list of all leaked passwords. It's a random subset of 10 million for research purposes.

Buge• 11 years ago

This is 10 million out of 1 billion that he has.

So there is only a 1% chance of a leaked account getting in this list.

meowface3• 11 years ago

I don't understand exactly why it's necessary to release usernames along with the passwords, or why it's ethical to do so. Stripping the domain portion of email addresses does absolutely nothing when you can find the real email, and other accounts of the victim, by Googling the unique part of the email address.

How does tying each password to its corresponding username help with password research, and does the value gained outweigh the cost of someone using this list for malicious purposes?

I'm not saying this should be illegal, but I'm struggling to understand the intent here.

detaro• 11 years ago

Probably to find out how many people do stuff like type their username backwards as a password/what kind of patterns they use. If that is useful enough information to warrant publishing data like this is debatable, yes.

exogen• 11 years ago

Also interesting, how features of a username might correlate with password strength. Who do you think uses a stronger password, someone with the username "carguy551978" or someone with the username "w1ntermute"?

jMyles• 11 years ago

A list of 10 million passwords alone answers almost no questions. In fact, it's probably possible to programmatically predict, with a depressing level of accuracy, what a great deal of such a list will look like, given the already available research about the distribution of complexity, the parts of speech and numbers commonly used and in what patterns, etc.

So, the next interesting question is: given the already plaintext-available lists of usernames and passwords, just how much coverage is there in the known space? Are your passwords known? Are your users' and clients' passwords known?

This document is perfect for a true positive on the matter of needing to deprecate particular combinations of username and password, and, as an obvious corollary, presenting evidence for consultation advice about the same. (Of course, being only a sample, it doesn't say anything about a true negative.)

a3_nm• 11 years ago

What about research to determine to what extent usernames with words in a certain language will tend to use passwords with words for the same language? (More generally, is there any connection between the bi- or trigram distribution on usernames and the one on passwords? In fact, do they just look the same, or could you tell given a string whether it's more likely a username or a password?)

Do usernames of people with weaker passwords have something in common? How do they differ from people with stronger passwords? In France there is a practice of picking names like "foobar42" or "foobardu42", where "foobar" is a first name and 42 a "département" (country subdivision) number, which I would associate to casual users. Here I could quantify whether people with usernames of this form tend to pick weaker passwords. Insert your favorite prejudice here about lame and skilled username patterns, and quantify how the password diversity of this group fares in comparison with others.

Is it true that the most common passwords were associated to usernames that were also common? Does username frequency correlate with password frequency? Are there more people with unique usernames or people with unique passwords?

In some countries it is customary to annotate usernames with the user's year of birth. Filtering on such usernames could give insight about the correlation between age and password quality, or identify which passwords are more or less popular given the user age. You could try to check correctness of the filter using the fact that some of those people may have used their birthdate (including the year) as a password.

If a seemingly rare password in the dataset only occurs for two distinct user names, then maybe those two user names actually correspond to the same user. Do such usernames have a low edit distance? Could you use this to learn general rules to determine, given two usernames, whether they seem to correspond to the same person?

I just gave those off the top of my head, and I'm not at all working in this field, but I'd have no trouble imagining interesting applications for this data that would not have been possible with the passwords alone.

meowface3• 11 years ago

I feel like most of those research questions could be answered if it was a "username -> password strength" mapping, in addition to a hash to study duplicate trends, rather than just "username -> password". Obviously there is no objective ranking of "password strength", but a decent approximation could be provided.

There are serious risks to having your username and password in a public list. Yes, all of these usernames and passwords were already technically publicly released, but to a lazy and ignorant script kiddie, finding or even being aware of those lists can be outside their grasp.

By aggregating everything into one list, you 1) increase the search engine visibility for all credentials, which means someone Googling the username of, say, an Internet commenter who pissed them off may find a plaintext password they could use to impact the person's life with much higher probability (I work in information security and have seen that happen on many occasions), 2) encourage script kiddies and fraudsters to spend time working through the list to find working accounts that other criminals have missed in the past decade, and 3) undo any work that paste sites like Pastebin and file sharing sites like Mediafire have done to remove copies of the database dumps. 1) may not apply if it strictly remains a torrent, but it'll probably be floating around public paste sites within a few days, which would likely mean search engine visibility for every username on it.

If even 0.01% of the users on this list have accounts compromised due to its release, then I don't think that cost justifies the research benefits relative to a more redacted version of the list.

pbreit8• 11 years ago

All possibly interesting questions (certainly not to me) but I fail to see how they would lead to any genuine advancements in authentication.

diminoten• 11 years ago

I dunno if he should have said "released", because he's not releasing any new data. Everything he's posted is already available to anyone with a search engine and a bit of curiosity.

So if you're concerned that information which wasn't previously public is now public, you can be at ease -- all of this data was not only public already, but less "cleaned up".

presumeaway4• 11 years ago

I'm struggling to understand the intent here.

A desire for a particular type of attention his ego seems to need.

Which, combined with either a moronic lack of appreciation for the hassle and damage he's going to cause to end-users who've already been hosed once before, or an arrogance that makes him not care, makes him difficult to fit for a white hat.

FTA:

This is completely absurd that I have to write an entire article justifying the release of this data out of fear of prosecution

What's absurd is his assumption that stripping domain names is somehow sufficient.

Edit: I'm getting downvoted like crazy here. Which is fine, but people seem to think it's ad hominem because I'm narrowing the reasons behind why someone would release a data set with a considerable price of collateral damage attached to it, while doing very little to mitigate that damage.

Just because the likely options for why someone would do such a thing don't speak favorably of the person, doesn't make it ad hominem. An ad hominem attack is seeking to undermine someone's argument by attacking their character.

I'm saying Mark Burnett made it difficult to assume good things about him after a stunt like that. If he actually made a real argument that what he did was sufficient, or that the harm he's going to cause is more than offset by the greater good it'll do (or some such argument), then we'd have something to try to undermine (whether legitimately or fallaciously), but as it stands, he hasn't even justified his actions.

totony5• 11 years ago

Ad hominem + ad hominem

Research requires data. If I want to do research on how best to implement my bank system, I would like to know what passwords are more likely to be contained in a dictionary attack. Usernames may have a high correlation with passwords and thus are useful. Considering all of these passwords can be obtained from obscure forums/websites and that the website where the IDs are used are not specified, I don't see why he could not release it to the public for researchers to use.

yalogin• 11 years ago

Before I go into the research aspect of it, there is no reason to hide the usernames from the passwords. They are already out there. The bad guys have them. So why not release them so that every one can look at them?

Also I am sure there are some research aspects to the usernames. At the very least behavioral deductions that can be drawn based on these combinations.

hasenj2• 11 years ago

I'm curios to see if any of my accounts/passwords have been compromised

chrisan• 11 years ago

Wouldn't be surprised if one of these sites already has it

https://breachalarm.com/ https://haveibeenpwned.com/

The author does not seem like the type of person who did the hacking himself to obtain these, but rather curated leaks into his database

dj-wonk• 11 years ago

Forgive me for doing so, but allow me to ask some possibly ignorant questions and perhaps play the devil's advocate for a moment. What about this release will help? What are the compelling research problems in the space?

We know users pick bad passwords. It seems to me the most compelling "problem" is hardly a research question -- isn't it about finding ways to encourage users pick strong passwords, not share them between sites, and not put them on sticky notes on their monitors.

Ok, putting my charitable hat again... My best guess is that researchers would like some idea about how long it takes to crack some percentage of accounts; e.g. with rainbow tables or other techniques?

The author mentioned "Analysis of usernames with passwords is an area that has been greatly neglected and can provide as much insight as studying passwords alone." What directions might a researcher take this?

m8urn9• 11 years ago

The main reason I have always included usernames and passwords in my research is because it allows me to analyze frequency data across multiple sites. Although I could have anonymized the usernames, I thought it would be best to keep them in. There is good value there. For example, there is quite a bit of overlap between usernames and passwords. Also, how many users include all or part of their usernames in their passwords. Plus, what usernames might hackers be most likely to try out?

The main goal here is to put the data out there and let other researchers find the value in it.

pbreit8• 11 years ago

So how would you utilize such knowledge in the real world?

hyperion2010• 11 years ago

The main issue is that attackers already have this data. They have a giant head start when when guessing passwords because just by looking at the username they can vastly reduce the search space. Whitehats and the public need to know how blackhats are reducing that search space. By making good faith publication and research on passwords risky (legally unattractive) we actively weaken security. I find it amusing that people find sharing password/username pairs questionable yet we don't seem to hold companies accountable when they loose millions of the things at once. Talk about a double standard. (RE: companies have lawyers and the little guy can get fucked for all anyone cares)

failed_ideas• 11 years ago

This is great, but if you use a password manager, it's very difficult to determine which, if any, of your accounts would be compromised. For myself, this would just be doing a dump and looping a few greps. But for family and friends, does anyone have any ideas for a less technical audience?

jpatokal• 11 years ago

If you're using a password manager and thus -- I hope -- using a different password for every service, it doesn't really matter if one service gets compromised. The compromised service in question will (hopefully) force password resets for all affected users, and the compromised password is useless elsewhere.

querulous• 11 years ago

1password has a limited ability to warn you of compromised passwords. they maintain a database of breaches that they warn you about in their client. the warning, however, is much less prominent than it probably should be

saraid216• 11 years ago

Instead of responding to breaches, I would recommend an annual (more frequent is better, obviously, but I think annual is fine) cycle of rotating passwords. Just pick a day and spend it replacing passwords. As a side effect, you get a mental update on exactly what identities you're managing and whether or not you want to modify or close them.

This should be fairly straightforward even for non-technical people, if they've got a grasp on actually using the password manager itself. The hard part is (1) getting the list of identities, which isn't too hard if you're hand-holding, and (2) actually remembering to do it. (Which is why annual is nice. You can peg it to a holiday you already celebrate, or substitute it for one you don't. Halloween, for instance, because breaches are scary? Or something.)

Bonus: if a breach happens that actually feels scary, just do the rotation ritual ahead of time. Not that big of a deal.

forgotX2• 11 years ago

Could someone describe the dataset for me? Is it just two columns with one for usernames and another for passwords? Or is there any other info included? I'm on mobile right now or else I'd grab it myself.

rinon• 11 years ago

yep, just 2 columns

m8urn9• 11 years ago

The first column is username, followed by a tab, followed by the password.

elchief• 11 years ago

Know what encoding it's in? Postgres is choking on UTF8 and Latin1

Kenji• 11 years ago

I could be relieved that my favourite password isn't in there but it's already been leaked by stupid, stupid engineers working for Riot (League of Legends video game) who stored it in plaintext and a hacker got it. It is a good practice to regularly change passwords anyways: If you're worried that your password is in there, you're doing it wrong in the first place.

ssully• 11 years ago

You're doing it wrong if you have a favorite password. Use a password manager; there are more then a handful out there that are multiplatform and easy to set up. If that isn't your thing then there are plenty of techniques for generating unique, easy to remember passwords.

jrochkind1• 11 years ago

As a final note, be aware that if your password is not on this list that means nothing. This is a random sampling of thousands of dumps consisting of upwards to a billion passwords. Please see the links in the article for a more thorough check to see if your password has been leaked. Or you could just google it.

jacobsimon• 11 years ago

_ everyone frantically searches for their own usernames _

LeoPanthera• 11 years ago

Fun!

    $ export LC_ALL='C'
    $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20
    55893 123456
    20785 password
    13582 12345678
    13230 qwerty
    11696 123456789
    10938 12345
    6432 1234
    5682 111111
    4796 1234567
    4191 dragon
    3845 123123
    3734 baseball
    3664 abc123
    3655 football
    3330 monkey
    3206 letmein
    3136 shadow
    3126 master
    3050 696969
    3002 michael

Edit: I used Wordle[1] to make a wordcloud of the top 1000 passwords: http://i.imgur.com/FImcPiG.png

[1] http://www.wordle.net

userbinator2• 11 years ago

In other words, supposing that this data is representative of most peoples' password practices, just trying these 20 passwords gives you a ~18% success rate for any username.

And... dragon. That's an unusual password to make the top-10 list. I think this might be a somewhat skewed sampling.

pgwhalen• 11 years ago

It makes equally little sense to me, but "dragon" is routinely high on top password lists.

MarkMc5• 11 years ago

For sensitive sites, my preferred solution to this problem is to add a sequence of random characters to the User ID field. The user would then authenticate with something like this:

  User ID: John-CPE4E38J
  Password: snoopy

For extra security the code would then move the random characters to the password so the authentication library would see this:

  User ID: John
  Password: snoopy-CPE4E38J

In this way even an attacker who gains full access to the server database would be unable to read the passwords (assuming they have been hashed well).

Also, the User ID can be stored in a cookie so that the User ID field on screen is pre-populated and the user only has to type "John-CPE4E38J" when he switches to a new computer.

More details here: http://security.stackexchange.com/questions/80352/is-it-a-ba...

crisnoble• 11 years ago

It makes no sense to me, but I do recall a middle school phase where I used either "dragon" or "drag0n" for my passwords. I didn't particularly even like dragons and I don't recall ever hearing others use it, so it really catches me by surprise. Whenever I see it in a top passwords list I am filled with memories of after school library trips.

maxmcd• 11 years ago

https://github.com/maxmcd/pwd-guess

yoha• 11 years ago

You forgot a zero:

   >>> (55893+20785+13582+13230+11696+10938+6432+5682+4796+4191+3845+3734+3664+3655+3330+3206+3136+3126+3050+3002) / 1e7
   0.0180973

That is, 1.8%. This is confirmed by http://maxmcd.com/passwords.html.

pavel_lishin2• 11 years ago

supposing that this data is representative of most peoples' password practices

That might not be the case; not all passwords are created equal.

As an example, my password to some goofy online game that requires registration is nowhere near as strong as the password required to log into my work email account - for some things, I prioritize being able to type a password in quickly on a mobile device over the danger of someone breaking in and playing a low-scoring word in online scrabble.

vacri2• 11 years ago

Looks like if you know someone called Michael, chances are that you need to talk to him and his loved ones about password hygiene...

WalterBright• 11 years ago

My name isn't Michael, but I use the password 'michael' all the time.

Edit: oh, crud

dvdhsu• 11 years ago

Cool! I found the usernames interesting as well, since not many studies have been done on them. "dragon" is both a common username and password! In reply to another child post: the enormous number of "michael" passwords probably has to do with the smaller, but still large, number of "michael" usernames.

I'd run some more commands, to find out how many "michael"s use "michael" as their password, but I've got to head out now. Would be interesting -- anybody up for it?

(Ooh -- you could even juxtapose the usernames against common American names by decade [1], and probably derive some data about the ages of these users as well!)

(Furthermore -- what if we started keeping track of most common passwords by decade? That could be super interesting! I wonder if it's changed much!)

  $ export LC_ALL='C'
  $ 0-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 3044 infouniq -c | sort -nr | head -n 20
  2119 admin
  1323 michael
  1113 robert
  1095 2000
  1049 john
  1041 david
  967 null
  940 richard
  922 thomas
  901 chris
  866 mike
  843 steve
  832 dave
  816 daniel
  812 andrew
  797 george
  765 james
  735 mark
  730 dragon

1. http://www.ssa.gov/oact/babynames/decades/names1980s.html

jcm13172• 11 years ago

For some reason I seem to be getting different values then you. However from what I got, there was only a single instance of a username 'michael' having a password 'michael'.

HOWEVER, of all of the people whose password is 'michael' 83 seem to CONTAIN the str 'michael'.

Of the set of usernames 'michael' there are 20 whose passwords contain the string 'michael'

Of the set of usernames containing the string 'michael' there are 276 passwords that contain the string 'michael'

I honestly expected much more.

libria• 11 years ago

I'm surprised (disappointed?) only 1 person used "correcthorsebatterystaple".

pthreads• 11 years ago

That is terrible, he/she used the same phrase as in the example!

300bps• 11 years ago

Don't read too much into this. My main email account is in the original list that was posted in October of 2014. My account that is listed is myname@gmail.com. The password though is not the password to myname@gmail.com but rather to my "junk" site password.

For almost any site I have an account, I use a strong, unique password. For sites that I don't care about at all AND that I suspect have security problems I use a standard common insecure password. It is that common insecure password that is paired with my gmail account.

num• 11 years ago

  10938 12345

That's the same combination I have on my luggage!

stinos• 11 years ago

So this dataset seems to be limited to english speaking qwerty using users, i.e. US only I guess?

benbristow2• 11 years ago

Heh. I use 'password' for when I'm purposely trying to make things unsecure (Like being nice and sharing my unlimited data via my phone's wifi hotspot on public transport).

cfrs• 11 years ago

here is the top 48K for lazy ones http://ix.io/ggh

lurkinggrue• 11 years ago

Cool! My password hunter2 wasn't at the top of the list!

totony5• 11 years ago

From the law quoted in the article, wouldn't it be illegal to simply make a course about computer security?

The teacher willfully (and knowingly) teaches the student about "possible means of access to a protected computer."

Note: According to http://www.law.cornell.edu/uscode/text/18/1029 teaching is defined as trafficking information ("the term “traffic” means transfer, or otherwise dispose of, to another, or obtain control of with intent to transfer or dispose of; ")

bikamonki4• 11 years ago

It seems very useful for research and also practical uses, like how about a REST API with this dump? get <password> will not only return true if it exists but how common and how weak it is, or will return a false for unique. Is there such a service out there?

lumpypua• 11 years ago

Go make it! :)

bikamonki4• 11 years ago

Hahaha sure if I did not had enough side projects of the side projects of the side projects ;)

joshmn• 11 years ago

I'm on it.

akerl_3• 11 years ago

This seems a bit like testing if your parachute was packed properly by deploying it. Once I've sent my password at a 3rd party API, it doesn't much matter what the API says: my password is no longer secure.

bikamonki4• 11 years ago

Correct, but every site where you signup does that and I do not think anyone cares. Maybe such API will not be for end users but for other apps to run signup forms against it and help users choose a better one. In any case, the whole password deal is broken. I now use my own offline pwd generator for the "important" sites but I guess I am not the average Internet user.

pbreit8• 11 years ago

How is that even slightly useful?

benbristow2• 11 years ago

Nice idea. Working on a simple Rails API now that will return a JSON response. Will take a while to import all the passwords though.

Currently got it returning this JSON: {"found":true,"password":"test","count":117}

farresito• 11 years ago

With all due respect, I think this is a horrible idea. Isn't it just better to simply download the dump and filter the information with the command line? Why would someone even want to write a program that connects to an API to get info like this? You don't really need to know too much to be able to filter values like those, and it's way more flexible.

avid8• 11 years ago

Even if this release has no implications for security, I think it may raise legitimate concerns for users' privacy. No doubt most users expect that their passwords will be known only to themselves. Many of the usernames contain real names, and many more could probably be traced to them. Ian Watkins was found to have "gloated" about his crimes in his password. With time and attention, I wonder whether such "dark secrets" could be found in this list.

uptown• 11 years ago

How are things like Twitter accounts hacked? Are they generally brute-forced with a list like this, or how do so many of them get compromised?

gayprogrammer• 11 years ago

Woah you are REALLY optimistic about law enforcement agencies wanting to focus on real criminals.

But Barrett Brown is not the first or only example.

Aaron Swartz is the only example I need to understand what to expect from the various US law enforcement agencies.

nyolfen• 11 years ago

it's kind of hilarious that it takes a case as transparently self-serving as aaron swartz to calcify a population as privileged and inured to the justice system as programmers to go "woah hey this shit might be kind of fucked up!!!"

ternaryoperator• 11 years ago

Aaron S. was not at all the first time programmers recognized the problem and acted on it. Perhaps it was the first time that you became aware of the issue. But there were large-scale campaigns as far back as Robert Morris's worm in 1988. Even then, programmers were rightly concerned with unfair punishment for hacking and were outspoken about their concern. Similarly, with the Randal Schwartz in 1995, and many times since.

ryanlol2• 11 years ago

Barrett Brown intentionally did everything in his power (including, but not limited to publicly threatening named FBI agents and their families) to get targeted by LE, and succeeded.

Swartz? Swartz knowingly did several obviously illegal things (breaking-and-entering?) and then acted shocked when he got charged.

His actions may have been morally defensible, but not legally. Law enforcement did their job there.

vaibhavmule• 11 years ago

Is your password and username in that list?

m8urn9• 11 years ago

Yes, three of my accounts are on the list.

kbart2• 11 years ago

Which one? I'm sure most of "hackers" here use different credentials for different purposes. Haven't found any of mine there though.

zaroth2• 11 years ago

There is an annual 'Passwords' conference [1], which I attended in 2012, and was blown away by quite how much researchers are able to do with these password lists.

Unfortunately, I was equally impressed with what attackers are able to do with them as well. An important point is that attackers tend to have better lists, because they are the ones stealing and cracking them, and these lists make them increasingly better at cracking passwords. Defenders use the lists for all sorts of analysis on how exactly users pick passwords.

For example, "complex password policies" have become increasingly popular. But do they actually increase the entropy of the chosen passwords? Surprisingly little, since users will "defeat" the policy by applying easy to guess "munging rules". Humans being human and such. The thieves have the lists, and learn to apply the munging rules and defeat the policies. Researchers need these lists so they can discover the same weakness and try to react.

More recent research looks at things like how effective the password strength indicators are at actually helping users choose stronger passwords. We also learn about how users choose different strength passwords based on the sites they visit and such. This is absolutely fertile ground for research which can improve how we perform authentication.

Yet another good use of the lists is in defending against online attacks. E.g. Failed attempts that follow the general probability distribution of the lists are easier to identify as bots.

[1] - I think all the talks are posted, although I'm not sure there's a central archive, each conference is identified as Passwords^[Year], e.g. Passwords^14 https://passwordscon.org/

pbreit8• 11 years ago

I'd be curious at what researchers were able to do with such a list (genuine, practical advances). It doesn't strike as particularly useful.

zaroth2• 11 years ago

Not a bad place to start: http://passwords14.item.ntnu.no/program.php

meric• 11 years ago

These lists were released by attackers in the first place. Attackers are always going to have the lists, and the only choice defenders can take is whether to use and distribute to the defender community, or not.

pbhjpbhj• 11 years ago

So this guy found a zero-day that works across different unzip binaries, or what ...!?

igonvalue• 11 years ago

Is there an http download link that would allow downloading from the browser (or with curl)?

rplnt• 11 years ago

There are services that will download a torrent for you. This one worked for me without registration http://www.direct-torrents.com/

yeukhon• 11 years ago

http://security.stackexchange.com/questions/46625/is-it-lega...

I thought of exactly the same. I was motivated by the password strength meter out there. How can you actually tell a password is strong or not or whether a password is known to attacker or not if you can ask (I was thinking along the line of private information retrieval) privately and get a probability rather than a yes/no based on all the known stolen credential out in the Internet (there are many Gbs files you can download)...

sandworm• 11 years ago

It was a mistake to release this today.

Everyone knows that legally questionable moves should always be made on a friday. That allows everyone in government to cool down for a couple days. By the time the weekend is over all the news outlets have moved on to whatever war just started up. You don't want some hothead prosecutor tweeting out a threat, forcing himself to follow through later in the week. Nobody picks a fight when 15 minutes away from a weekend.

Watch the NSA/CIA/MIB admissions. They always stage their spying/torturing me culpas on friday afternoons.

naradaellis• 11 years ago

In the show West Wing they called it taking out the trash.

srcole• 11 years ago

What sorts of analyses are you guys planning? Maybe: -clustering of passwords. are aspects of the username biased towards certain clusters? -distribution of alphanumeric characters at each position of a password (e.g. 1 is a disproportionately common final character) -differences in password strength between usernames with male and female names

hueving• 11 years ago

I wish there was an origin with these. A username/password combo I use on a ton of sites I don't care about is on here. It would be nice to know which is one leaked it.

ttty• 11 years ago

Many companies, such as Facebook, also monitor public data dumps to identify user accounts in their user base that may have been compromised and proactively notify users.

That is smart!

jcm13172• 11 years ago

Hunter6 is used as a password 9 times...

jammycakes• 11 years ago

Just a thought here. As far as I can tell, many bona fide security researchers seem to be independent consultants. Would they be less at risk of prosecution if they were handling sensitive data such as user names and passwords under the coverage of universities and/or similar accredited institutions operating under protocols as to who can and cannot access the data?

It would probably be more security theatre than actual security, but I'd imagine that it would at least keep the FBI happy.

levlaz• 11 years ago

If anyone wants to check their username, I have a searchable DB up now. https://levlaz.org/passwords

osw• 11 years ago

awk '{ print $2 }' 10-million-combos.txt | grep 1234 | wc -l

only 180896 people have 1234 in their password, thought there would be more

tomkinstinch• 11 years ago

To save a moment of time, here's a quick check that won't save the password string to your command history:

read -e -s -p "Password: " password && grep -i $password 10-million-combos.txt | wc -l && password=""

ommunist• 11 years ago

I thank the post author for releasing this data. I found one of my accounts there and changed password to a more secure one.

_0vzd• 11 years ago

Went ahead and performed a Levenshtein distance analysis from this list, and made a graph of it. Number 8 seems to be the sweet 'secure' spot that most people latch onto, though the distribution curve is interesting - or very human-like: http://pp19dd.com/2015/02/levenshtein-distance-10-million-us...

I Am Releasing Ten Million Passwords

Related Stories