Slashdot Mirror
Analyzing 20,000 MySpace Passwords
Rub3X writes "Author found 20 thousand MySpace passwords on a phishing site and did some tests on them. They were tested for strength, length and a number of other things. Also tested was the most popular password, and the most popular email service used when registering for myspace."
spent some of that time analyzing the strength of his hosting plan
[place
Most common passwords used:
13 - cookie123
12 - iloveyou
12 - password
11 - abc123
11 - fuckyou
11 - miss4you
Why don't sheep shrink when it rains?
Mirrordot http://www.mirrordot.org/stories/65dbc3fb38c8508be da018cb179a7607/index.html
It's a fairly interesting (if not too detailed) analysis. A commenter makes a critical observation, though: these were passwords entered at the phishing site, not MySpace. As such, some people can easily recognize it's not the original site and add such gems as "fuckyou".
Personally, I try to fit the following in every eBay phishing page I see:
Field 1: "just who do you think you're kidding?"
Field 2: "better luck next time, dolt."
Say, 10% of passwords contained on a site was obtained using a dictionary attack. Then perform analysis on these password. Conclusion that basing on statistically significant number of passwords (10%, >10000) almost 100% of passwords on the site are vulnerable to dictionary attack is simply wrong - the sample was biased.
Similar about phishing-originated passwords. Phishing is a result of bad practices on user side, and usually clicking attachments in spam, using insecure browser and no antivirus is connected with using poor quality passwords. The results WILL show worse quality of user passwords than real simply because the passwords originate from subset of users who know less of security in general (and as result, got hacked.)
Anagram("United States of America") == "Dine out, taste a Mac, fries"
The analysis is flawed as a general indicator of MySpace passwords because it is only a subset of people who would actually fall for phishing attacks. Of course such people will have horrible password habits
Now, I am changing my password to cookie321, no one will see that coming.
It works fine for me. Post your Slashdot password and someone will login and check that your account isn't broken.
Thanks,
Slashdot Admin
I made a copy, with images: http://student.science.uva.nl/~sschroev/junk/myspa ce.html
(If the server does not manage I will remove the page)
It would be interesting to see how many of the names in that list use the same password for MySpace account as they do in their email account.
Slashdotted [...] CPU quota exceeded.
Indeed. Yet, just by reading the summary, I can tell it would have been a juicy article:
They were tested for strength, length and a number of other things.
Circumference? Growth ratio?
Links back to that guy's host XD
Goten Xiao
http://www.networkmirror.com/pMNGiaubQFpIgJLX/cybe r-knowledge.net/blog/2006/09/16/analyzing-20000-my space-passwords/index.html
"I'd rather be a lightning rod than a seismometer." -Ken Kesey
http://www.mirrordot.org/stories/65dbc3fb38c8508be da018cb179a7607/index.html
I have a few "sets" of passwords that I use. Basically it goes like this:
;)
1) Online banking - Very complex ( as complex as my banking site will allow that is ) / Important work related passwords
2) Unimportant work related passwords (Such as the log in to view the cacti graphs for example) / Public websites that require a password and I care a little bit about
3) Public websites I could give a rats ass about having broken into. Myspace would be listed here. So would my slashdot account.
So my point is just because people use crappy passwords for myspace doesn't nesasarily mean they don't have a clue......but being caught by phishers does.
======== In the future, everything will be artificial. ========
How did you get the combination of my luggage?
"Really, it should read: the most commonly used passwords, by MySpace users who were targeted by and fell for a phisher" - or by people pretending to be MySpace users when targeted by a phisher - or by people giving a bogus password when targeted by a phisher.
Ben Hocking
Need a professional organizer?
And when you gaze long enough into the code, the code will also gaze into you.
Due diligence would have him write a script to check which user/pass combinations were valid, and then analyze only those.
meh
username: CmdrTaco
password: DiggFTW
TIA!
I think you should take the same advise. I just stole your account and now I'm posting as you Mr. Coward.....HAHAHAHA!
Yes.. the Digg effect, not the slashdot effect
I almost sense a disappointment that MySpace users didn't come out looking stupider. Give the MySpace users a break! Their computer illiteracy is made painfully clear, but imagine if Slashdot had a comparable way to highlight its posters social illiteracy. Perhaps there would be MySpacers writing on message boards about how stupid all Slashdot users were for their poor fashion sense. Yes, that would be stupid, but comparably as stupid as the blind, generalizing hate for MySpace users that is prevalent here.
1. Put up a site that claims to have tens of thousands of passwords up.
2. Post news on Slashdot.
3. Users go to site, and SEARCH for their password. Hacker now has REAL passwords thanks to the searches.
There was an MIT study claiming that the strength of passwords was affected by length alone. Because of brute force cracking, the longer the password, the longer it took to break. Consider the three character password where I allowed only numbers, and upper and lower case letters. Each position in the password would have 10 + 26 + 26 = 62 possibilities. A three letter password would have 62 * 62 * 62 combinations. Now, if I required "strength" by requiring the use of a letter, and both upper and lower case, I now have only 10 * 26 * 26 combinations. Requiring "strength" always reduces the set of possible combinations for the password.
At the bottom of his article it has an add for:
'Need a cheap host that can survive the Digg effect?'
That links to his webhost... Guess it doesn't survive it very well, eh?
Recently while auditing user accounts this password turned up as one of the top 10 most common passwords - if you don't know, it's Fox Mulder's password in the X-Files. Passwords used in movies and tv are surprisingly common, 'joshua' is pretty common, and quite a few people use 'CPE1704TKS' proving that just because people remember detailed trivia from hacking movies they don't know what makes a good password.
My password is: "admin". Thanks for looking into this. (Username is also "admin")
My turnips listen for the soft cry of your love
don't forget endurance (:
-sekunder
Twenty-two years on, here's my obvous password detector. This is C source code I wrote in 1984. This simple piece of code will prevent the use of passwords that are English words, by requiring that the password have at least two sequences of three letters not found in the dictionary. The "dictionary" is compressed down to a big table of hex constants; it's a 27x27x27 array of bool, with a 1 for each triplet found in the UNIX dictionary. So the code is simple, self-contained, and does no I/O.
Put this in your password-change program and dictionary attacks stop working.
The code is a bit dated; this is original K&R C, not ANSI C.
I should do a Javascript version and give that out. The code is so small that it could easily be executed on user-side password pages.
Most interesting to me is that despite most of the passwords being decent it makes not a lick of difference in these people being phished. Once again, being sharp and understanding of the big picture is more important than following any isolated rule about security. Good luck getting that out to the masses, though :)
Cheers.
It wouldn't do a ton of good since your average phisher has access to a ton of zombies they can verify a password list without triggering any IP:failedlookup ratio and banning themselves from the site.
Give a man a fish, he'll eat for a day, but teach a man to phish...
Is *******. That way I can always see what I'm typing.
He came up with a rating scheme from 1 to 4, where 4 is the "best" password. And he says "I consider strength two fine for a myspace account." Very good point: Not all websites need the same level of password strength.
My personal pet peeve is websites that probably only require a 2 or 3 (on his scale) but demand strength 99. For example, forum sites that reject passwords that my bank would consider good enough.
My plea to anyone reading this who develops websites: The strength of the password only has to match the importance of the information that it's protecting.
Thus endeth my rant.
I read both sites because I like the different articles on each. But lately many of the same articles are on both. I suspect people are seeing articles there and submitting them here. I'd like to see variety again.
It's a girl!
My password is ********
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.