The Top 50 Gawker Media Passwords

wiredmikey writes "Readers of Gizmodo, Lifehacker and other Gawker Media sites may be among the savviest on the Web, but the most common password for logging into those sites is embarrassingly easy to guess: "123456." So is the runner-up: "password." On Sunday night, hackers posted online a trove of data from Gawker Media's servers, including the usernames, email addresses and passwords of more than one million registered users. The passwords were originally encrypted, but 188,279 of them were decoded and made public as part of the hack. Using that dataset, we found the 50 most-popular Gawker Media passwords."

Comments

Not Really Sold on the Correlations

[eldavojohn]

I don't know about the graphs and statistics they generated from this. First of all, you don't know how many out of the total set of users were stolen and the ones that were decrypted were probably the obvious ones (via rainbow tables? was Gawker using salt?). Perhaps this adds a bit of slant to any statistics generated? Anyway:

A plurality of Gawker Media passwords are six characters long, but we wondered whether that and other results might differ based on the user’s email provider. Indeed, users of Google and Yahoo’s email services are more likely than Microsoft email users to have passwords of eight or more characters.

Well, Hotmail and Yahoo! require six characters or more and Google requires eight characters or more. Explains the Google/Microsoft difference anyway: People are lazy. While you're statements aren't false, I fail to see their confidence or usefulness. Or are we just trying to pat ourselves on the back for using Google and being part of the "elite?" The funny thing is that if your password is showing up here, it's just as "strong" as the other ones that fell victim to this kind of attack! Regardless of length! Take your pick, "unicorns" or "$r-P_5"?

Popular passwords vary, as well: Gmail users are bigger X-Files fans ("trustno1") and more likely to opt for the slightly clever variant "passw0rd."

Or you're just staring at random data trying to make something out of it. "Slightly clever variant"? Ha, well, whoever decrypted this passwords had that one in mind, you know that for sure. Anything even remotely clever would not show up in here.

Yahoo and Microsoft email users, meanwhile, are much more likely to get sappy with their passwords: "iloveyou."

Come on, one example leads to that kind of generalization?

Re:Not Really Sold on the Correlations

[initdeep]

google may require 8 characters now, but they havent always. i have 6 character passwords on several gmail accounts.

and another thing i'd like to point out.
just because a person uses an "easy" password for something as trivial as a "commenting" user login, doesnt mean they use the same type of password on something more important.
anyone who used/uses the gawker commenting system knows it's a heaving pile of shit, and that may lead people to utilize simpler passwords because they routinely cannot get the system to send them "forgotten password" emails in a timely manner.
Also, my guess is many people have set up sock accounts (noooo, that never happens on commenting systems) and these accounts may very well likely be the ones with "easy" passwords and they utilize "throw away" email accounts like yahoo and msn to create them.

Re:Not Really Sold on the Correlations

[Anonymous Coward]

Came here to say this. This is a stupid article. The ones "decrypted" were once that had known matches in hash databases. So of course you get a bunch of obvious ones!

Re:Not Really Sold on the Correlations

[konohitowa]

You could have saved yourself a lot of analysis by rating the merits of the article from the first sentence. ;)

Re:Not Really Sold on the Correlations

[HideyoshiJP]

But, but, but... knee-jerk... and irrational... and... you ruin everyone's fun!

Re:Not Really Sold on the Correlations

[ThePhilips]

just because a person uses an "easy" password for something as trivial as a "commenting" user login

And why the hell one needs a password to comment? To me that was always an overkill.

OpenID was poised to solve the problem (allowing single sign-on) and partially does that already. Yet still many sites do not support it - Gawker included.

Re:Not Really Sold on the Correlations

[PReDiToR]

I'd rather have multiple passwords and this happening every few years than OpenID, for the record.

One leak of the OpenID db, one PFY with a grudge, one Swedish website later and we're all screwed.

Plus whoever owns OpenID knows every site you visit and the frequency.

Keep it.

Re:Not Really Sold on the Correlations

[lupine]

I had an account on Gawker, and my password was not very complicated, better than those listed, but still very simple. Why would I be so careless about login security? Because my Gawker account had no real information.

I signed up using a sneakemail.com temporary email address which has since been deleted so the only thing the hackers got was a junk email address and a junk password. No reason to secure something that is worthless.

Re:Not Really Sold on the Correlations

[D Ninja]

Well, Hotmail and Yahoo! require six characters or more and Google requires eight characters or more. Explains the Google/Microsoft difference anyway: People are lazy. While you're statements aren't false, I fail to see their confidence or usefulness. Or are we just trying to pat ourselves on the back for using Google and being part of the "elite?" The funny thing is that if your password is showing up here, it's just as "strong" as the other ones that fell victim to this kind of attack! Regardless of length! Take your pick, "unicorns" or "$r-P_5"?

Except, that's not entirely true. Yes, while people typically use very weak passwords, Gawker's mistake was that they used DES (WTF?) to encrypt their passwords. DES has been shown to be not strong enough for quite some time now. On top of that, Gawker did not handle passwords correctly in the first place. No salt. No hash. It was just one big screw up.

So, yes, people choose bad passwords, but that can only result in a small compromise (one account). In Gawker's case, they had the whole entire system compromised, and it was very easy to crack those passwords.

Re:Not Really Sold on the Correlations

[AliasMarlowe]

The funny thing is that if your password is showing up here, it's just as "strong" as the other ones that fell victim to this kind of attack!

Not exactly. It does not mean that all of the passwords were "as strong" as each other. It means that all of them were weak enough to be broken by an attack of this strength. Some of the better ones might not have been cracked by a less capable attack.

Take your pick, "unicorns" or "$r-P_5"?

It's clear that the 8 character lower-case "unicorns" could be broken by a simple dictionary attack (maybe 20-ish bits of entropy), while the 6 character "$r-P_5" obviously would not. The latter would need a brute force across 6 characters, mixed case + numeric + special, about 80^6 possibilities or 38 bits of entropy (and rainbow tables would probably not help much). Both are indeed a bit too short to be considered strong, but one is clearly much weaker than the other.

If your point was that length alone does not give strength to passwords, you're preaching to the choir.

Re:Not Really Sold on the Correlations

[Sancho]

The beauty of Open ID is that anyone can run a provider. Even you.

The ugliness of it is that you log in with a URL (that's a paradigm shift for a lot of people). Ever seen Google's OpenID URL? https://www.google.com/accounts/o8/id (and I can never remember if there's a trailing slash, so I often end up trying to log in twice.) And if the provider goes down, you're locked out of pretty much everything. Of course, that's a benefit, too. If someone breaks into your own OpenID server, you can pull the plug and they lose access to all of those accounts.

Re:Not Really Sold on the Correlations

[ThePhilips]

Plus whoever owns OpenID knows every site you visit and the frequency.

I'd take that - over maintaining manually a private DB with passwords.

I'd rather trust one (or few) OpenID provider(s), than hundreds of random people who run the dozens/hundreds sites I visit monthly. Both options have bunch of pros and cons - but at least the former has advantage of being convenient and non-obtrusive.

Re:Not Really Sold on the Correlations

[Sancho]

There was a salt. That's why of the 1.2million accounts on Gawker, only about 200,000 passwords were recovered. It's looking like Gawker basically used crypt().

Re:Not Really Sold on the Correlations

[mlts]

An alternative is to use a throwaway OpenID account. However, why let people be able to get tracking data from one account with multiple sites? Might as well have a different, throwaway ID for every site, just because of the stupidity of having to register to see a print view or leave comments, and the registration process almost always demands a lot of personal information that isn't relevant. Why do websites demand addresses (and bother trying to check them), other than just trying to get more stuff to sell. In those cases, I just give them the address of USENET Central Administration [1] and continue on.

[1]: 1060 W Addison Street to be exact.

Re:Not Really Sold on the Correlations

[PhrostyMcByte]

The only thing this study shows is the most popular passwords used by people who don't care about security.

Good passwords will be reasonably unique. When you try to find the most common passwords, of course the bad ones will bubble up to the top, even if only a fraction of a percent of people use them. This list might be interesting, but it doesn't really show anything significant about Gawker's users.

Re:Not Really Sold on the Correlations

[tlhIngan]

And why the hell one needs a password to comment? To me that was always an overkill.

Because it otherwises kill all benefit to commenting.

A passwordless comment system is like SMTP today. Registration and CAPTCHAs help reduce a good chunk of spam, and brings it to a level that can be manually managed.

And sometimes, having an account gives you benefits, like remembering personal preferences (Gawker has some preferences like an avatar and your default comment view). But losing my account there would be more of an inconvenience so I use a simple password. Oddly though, I couldn't find my account on that Google tables list.

Re:Not Really Sold on the Correlations

[kefkahax]

Yes, definitely. They likely wanted to get their hacked information out fast. So, I doubt they let "John the Ripper" or anything else run for more than a few hours, and probably on a weaker character set like azAZ09. That would definitely obscure the results. I don't think it's a good sample to measure password security on. The same way, a few years ago, someone found a phisher's log file and posted it to full-disclosure. While that would give you more difficult passwords, the sample of users is questionable and not all of the passwords were real (you'd need to filter out the e-mails like fuck@phish.ers). Besides that, I assume that I'm not the only one that uses stronger passwords for say my server and my various e-mail addresses, than I use for any other service like facebook, gaming forums, etc..

Re:Not Really Sold on the Correlations

[thePowerOfGrayskull]

One leak of the OpenID db, one PFY with a grudge, one Swedish website later and we're all screwed. Plus whoever owns OpenID knows every site you visit and the frequency. Keep it.

The answer to all of those: just run your own - that way it's under your control from the start.

Re:Not Really Sold on the Correlations

[mlts]

Stuff like that is inexcusable. Basic stuff like doing a salt (128 bit minimum, 256 bits recommended), appending it to the password the user types in, then running both through a SHA-256 blender for a good number of rounds [1] is SOP for anything to be taken seriously these days.

Why do people keep forgetting the need for salts in password storage? Even the old BSD and SVR4 UNIX variants had salts and computation rounds in the old crypt (3) password storage before the days of /etc/shadow. It is a lot tougher to guess a password when one can't just use a precomputed rainbow table.

[1]: This can vary on the system. TrueCrypt uses 1000 rounds, iOS 4 uses 10,000 rounds. Preferably a number of rounds that doesn't add significant load to the server, but is good enough to slow down brute force attempts. One idea might just be to have the client do the password obtaining and send a decrypted token so the server doesn't have to waste CPU cycles.

Re:Not Really Sold on the Correlations

[AndrewNeo]

That's what OpenID delegates are for. I have a page set up that I log in to OpenID sites with, and that page contains metatags to forward to the provider of my choice. Provider goes down, I can switch internally and never change my login URL.

Re:Not Really Sold on the Correlations

[mcgrew]

anyone who used/uses the gawker commenting system knows it's a heaving pile of shit, and that may lead people to utilize simpler passwords because they routinely cannot get the system to send them "forgotten password" emails in a timely manner.

For most sites that demand a free user account to read the content, a strong password is idiotic; I use a string of 1s for most of them (newspapers are the worst offenders).

For my home PC and websites that I need security I have a long string of random characters that I keep written down; the lock on my front door is my security.

For my work PC I make it as strong as possible while easy for me to remember.

Re:Not Really Sold on the Correlations

[Sancho]

They were basically using crypt. There was, in fact, a salt (though not a good one.)

Also, Gawker switched to using bcrypt at some point, but since many people didn't change their passwords after the switch, they were still storing the old DES passwords.

Re:Not Really Sold on the Correlations

[Sancho]

That's really, really excellent and something I wasn't aware of in OpenID. Thank you for the pointer!

Re:Not Really Sold on the Correlations

[gorzek]

Which would have easily been resolved by requiring a password change at the next login and locking the accounts until that occurred. Just sounds like laziness on Gawker's part.

Re:Not Really Sold on the Correlations

[Anonymous Coward]

They apparently used DES (Unix crypt) for the passwords. Which was great when it was invented in the 1970s. It does have a salt (12 bits, if I remember correctly), but the password is limited to 8 characters.

The salt makes using rainbow tables more difficult, but likely not impossible. At least, it'd mean you'd have 4096 times as much work to do. I don't think anyone's actually used rainbow tables against Unix crypt though. It's a very low value target (most Unixes stopped using it years ago), and there are plenty of higher value targets (like Windows LM and NTLM hashes, or plain MD5) that don't use any salt at all. I gather it'd take a year or so to generate a decent set, even using lots of expensive custom hardware.

Something like John the Ripper can attempt to crack Unix crypt passwords at millions of attempts per second. Using such a tiny salt doesn't really help much. You can easily spread this out among lots of PCs. DES crypt password hashes won't hold out for long against that kind of attack, especially if the passwords are guessed intelligently.

Most password cracking tools are able to use dictionaries of common passwords (which is how it gets "password"), and are able to combine them (so it can get passwords like "iloveyou"), or mangle them (and get passwords like "passw0rd" or "trustno1"). Even the complete set of alphanumeric passwords is only 200 billion combinations. A small cluster could completely cover that entire space in a couple of weeks.

Re:Not Really Sold on the Correlations

[JamesP]

I don't know about the graphs and statistics they generated from this. First of all, you don't know how many out of the total set of users were stolen and the ones that were decrypted were probably the obvious ones (via rainbow tables? was Gawker using salt?). Perhaps this adds a bit of slant to any statistics generated? Anyway:

Apparently Gawker was using DES (really?!) and with the password in its source code

So yeah, it's pretty easy to decode it

Re:Not Really Sold on the Correlations

[Anonymous Coward]

Elwood, is that you?

Re:Not Really Sold on the Correlations

[houghi]

The beauty of Open ID is that anyone can run a provider. Even you.

That is why I use (the depricated) http://siege.org/phpmyid.php
Not sure what I am going to use as a replacement.

Re:Not Really Sold on the Correlations

[tibman]

LiveJournal (the creator of OpenID, if i remember correctly) doesn't require anything other than an email to sign up. My account is pretty old but i use it everyday. I have tried most "social" sites as they came out (geocities, LJ, friendster, myspace, facebook) but i always end up back at LJ : )

Re:Not Really Sold on the Correlations

[Java Pimp]

I don't think the point was that they could "decrypt" obvious passwords. I think the actual point is the fact that real people are STILL using obvious passwords!

Either they are naive and think their account won't get hijacked or they don't care since the account was likely just created to make one comment in the forums and doesn't matter.

Re:Not Really Sold on the Correlations

[falsified]

Thank you. I use easy passwords all the time for crap like this. Why waste one of my strong but easy-for-me-to-remember passwords on something that doesn't actually have any connection to my personal life or my money?

Re:Not Really Sold on the Correlations

[Anonymous Coward]

First of all, you don't know how many out of the total set of users were stolen

Except we do. They tell us in the readme they got 1.3 million of the 1.5 million total rows in the database. So around 85% of the total set.

and the ones that were decrypted were probably the obvious ones (via rainbow tables? was Gawker using salt?).

No need for rainbow tables! Again they explain in the readme. The passwords were truncated to 8 characters (you only need the first 8 characters of your password to login), and stored using DES (no, not triple DES, just plain DES). DES has long been broken, and even if it wasn't, the 56-bit key is trivial to brute force on modern computers.

Re:Not Really Sold on the Correlations

[Khopesh]

was Gawker using salt?

I would hope so, but it's pretty irrelevant since the attacker can derive the salt using a known user/pass pair (...unless the salt were a function, but I don't know if that's done).

The article's correlations are wholly speculative and ill-informed; I highly doubt there was any notable difference between hotmail v google v yahoo users with respect to statistical significance. The video at the bottom was almost completely unrelated, including a few minutes of banter that could have been constructed from the slashdot article summary. The video's target audience was the general public while the article's audience appears to be the IT-savvy. They also fail to mention whether the password "f---you" was censored by WSJ or by the users (take a wild guess), which seems unacceptable if they're supposedly showing real data.

Remember when the Wall Street Journal had integrity?

Re:Not Really Sold on the Correlations

[icebraining]

Exactly. A couple of "link" tags in your website's main page and you're done.

Re:Not Really Sold on the Correlations

[icebraining]

4chan can manage with only CAPTCHAs. (And yes, I know that spam in /b/ is indistinguishable from normal posts, but there are more boards in 4chan).

Re:Not Really Sold on the Correlations

[metrix007]

May as well add every other company to that list. I am still using a 6 digit lowercase letters password for gmail and hotmail, something both their password policies prohibit, but I have never been asked to change it.

123456?

[oodaloop]

What a coincidence! That's the combination to the airlock protecting the planet!

Re:123456?

[140Mandak262Jamuna]

Cleverly fooled ya! The real combination is 12345 not 123456

Re:123456?

[AndrewNeo]

"Cleverly fooled ya!"? I think you meant FOOLED YOU!

Please excuse me for a moment

[arcite]

I have to change the password on my luggage.

Re:Please excuse me for a moment

[ottothecow]

Don't worry, I'll just use the TSA key.

My password

[Krneki]

I guess I'm the only one to use ****** .

Re:My password

[Anonymous Coward]

I was just saying the other day how ****** was the best password, because if someone haxored your computer and found a text file with passwords that were all *****, one might assume you were using a the number of asterisks to remember default passwords of a certain length.

Re:My password

[jimicus]

I'm sure someone else must use hunter2

Re:My password

[Anonymous Coward]

Some logins automatically put in a default number of asterisks so that you can't guess the password off of the number of asterisks.

Re:My password

[Anonymous Coward]

Yeah, gawker does, for their password salt. Highly secure.

Re:My password

[MacGyver2210]

You know, it just shows up as ******* when you type hunter2. Slashdot automatically blocks your password if you type it.

Re:My password

[Tsunayoshi]

wait, how did you know my pw?

Re:My password

[Anonymous Coward]

er, I just copy pasted YOUR ******'s and it appears to YOU as hunter2 cause its your pw

Re:My password

[mlts]

The old Wizardry games on the Apple ][ would add a pseudo-random number of asterisks when typing in a character password. This way, if someone saw 8 asterisks, it could be a 2 character password, or longer. Since it was the same number of characters, one could use that to doublecheck if they had the right password typed as well.

Smarter security systems also follow this lead. So, "******" may not be "hunter2", but "1234".

Re:My password

[Anonymous Coward]

I just checked and none of the people posting before Tuesday December 14, 12:11 AM EST use hunter2 or ******** as their password.

Re:My password

[Technician]

That password is too short to use on my site. A minimum of 8 is required. It looks like xyzzy and x-ray has fallen out of the top spots.. I must be getting old.

Re:My password

[vegiVamp]

It's wide-open in the post, of course. You do realise that the password box only displays stars or dots to you ? We're on the other side of the slashdot servers,so we see it in plain text.

Re:My password

[aztracker1]

prior password of mine: FsckThisShiznit!1 .. just incremented the 1 at the end for a while. upper, lower, number, special-char and easy enough to remember. After I get through 9, I start with a new short expression, with !# at the end. It's a pain when you have systems that require a new password every couple weeks for work, and just change them all to be the same. and only different enough over the course of 3-4 months, that you have to remember the first part, and which number you're on... "Good enough for gov't work!1" or similar should work too, what I hate is systems that limit the length of your password.

Re:My password

[robthebloke]

Sadly for you, that feature seems broken at the current time..... :p

Re:My password

[SmlFreshwaterBuffalo]

Wait a second, how do you know my password?!

Re:My password

[Thud457]

I wonder if anyone used Chuck Norris thinks Netscape engineers are weenies, he has the _NSAKEY

Re:My password

[jnpcl]

you can go hunter2 my hunter2-ing hunter2

Re:My password

[ConceptJunkie]

I doubt anyone under 40 is using "xyzzy" or "plugh".

Re:My password

[Technician]

Last time I used either was on a dial up BBS.

The fewer users the lower chance of being attacked. Those words are now included in any good dictionary attack.

No need

[SuperKendall]

I have to change the password on my luggage.

Don't worry about it; I took the lock also.

So what?

[Frosty Piss]

You know, it's not like Gawker is everyone's primary email account or has access to their bank records - it's entertainment. So honestly, what's the loss here? For me as a "user", very little. If I even care that much, I'll change my UID/Pass. But maybe, since it's probably a throwaway account anyway, I'll just sign up for a new one and move on.

Seriously, what are "hackers" going to do with my account? It's not even under my real name.

Re:So what?

[Nerdfest]

Most people tend to use the same username and password for every site they register on, and their email.

Re:So what?

[Anonymous Coward]

Depends on whether you meticulously memorize or keep a record of dozens of passwords, each separate for every site you've ever signed up for, or if you use a handful of passwords for all sites. Now you have to go and change them all or risk one of your accounts being compromised.

Re:So what?

[word munger]

Well, 123456 wouldn't work on every site, so I kind of doubt that.

Re:So what?

[AnonChef]

Unfortunately there is a very good chance many have used that same email/password combo on more important sites.

Re:So what?

[oldspewey]

Sadly, I know lots of people who use the same password for everything they do online. Lots of them provide their real first and last name when asked too, and have one single email address that they use for "verification" purposes everywhere they go. So that means a hacker who has your $ASININE_SOCIAL_SITE password now has a good shot at all your other passwords, and if they care to take the time to figure out your likely username (based on the real name you provided and the real email address you provided) they can go ahead and log in to Amazon and buy themselves a nice Christmas present.

Re:So what?

[dreamt]

Exactly. Look at how many passwords were gizmodo or engadget. Its a useless account -- does anyone really care if someone is now able to post comments or get replies to a site like this. It shows that users have individual passwords for the sites, and probably good odds that they are using "real" passwords for sites that matter.

Re:So what?

[Sloppy]

Yes they tend to, but the top 50 are almost all counter-examples to that tendency. It's the bottom 100000 that you should worry about.

Re:So what?

[clone52431]

No... for the really secure sites you need to use Abcd1234

Re:So what?

[RyuuzakiTetsuya]

4chan's /b/ and anons are like, a bouncy ball, a ball that is capable of making you happy, and be fun.

Lesson:

Do not taunt happy fun ball.

Re:So what?

[Anonymous Coward]

I use more secure passwords when I care about the account or what it contains, or there's a bigger chance of spam. Less secure passwords on fluffier sites. If someone breaks into Slashdot, the worst that happens is that I have my karma vanish and start over with more digits in my ID, not a big deal. In some cases, "123456" is perfectly find for some web sites.

Re:So what?

[icebraining]

I do neither. My passwords are generated by a simple algorithm based on a fixed part and the website's domain all passed through a hash and cut to 30 chars. Based on a suggestion by a fellow slashdotter whose nickname I can't remember:|

What this shows us

[word munger]

This doesn't show how stupid people are about their passwords; quite the opposite. All you're using the password for is to comment on a stupid blog post. It's actually kind of interesting that a lot of people seem understand that concept and so don't spend a lot of time generating a secure password.

Re:What this shows us

[Amorymeltzer]

I don't think that's it, or at least, there's no way to draw that conclusion without seeing everyone's passwords for everything. Most people use the same password for most everything, tacking on a letter/number/upper case/symbol as required by certain sites. The only real creativity is in the workplace, at companies where passwords must be changed every [1-3] months and you cannot repeat. After about a year, you gotta start coming up with new concepts. That can never work for something like Gawker or Slashdot because, as you say, it's not vital, but that doesn't mean people are using an insecure password because they recognize the lower importance. Besides, that's like switching wallets when you have ten bucks or 200 on you.

Re:What this shows us

[janeuner]

> Most people...

I'm sorry, is this FOX News?

Re:What this shows us

[poetmatt]

if your username + password lets people guess on anything, they're going to try it on every site that exists to try to exploit it.

so actually, yes, this does matter if you didn't take the proper steps to make it hard to identify the email address/username/etc used in the original registration.

Re:What this shows us

[Anonymous Coward]

You can make a reasonable assumption of people's habits by running the list from a simple site against a few more important sites (banking, Amazon, eBay and the like). If you get a reasonably high hit rate you can say that people generally use the same weak passwords for important sites that they use for throwaway comment sites. Now that is a much more interesting news story, and the fact that they've not run with that story tells me they're either incredibly lazy or it was a non-issue (i.e. most people had better passwords elsewhere).

Re:What this shows us

[Darinbob]

Very interesting too that these passwords were obtained by decrypting the password file. So if you had a very complex and secure password, these guys now know what it is. If you used that same password on a site you care about, maybe with a different digit on the end, you've potentially lost a bit of security elsewhere. But if your password on gawker sites was "password" and you only used that on other fluffy sites, then you haven't lost that much.

Re:What this shows us

[muphin]

all the forums and blogs that require me to register i just create a general user account, and simple password, i dont care if it gets hacked cause all i used it for were comments, being forced to register just to post a comment these days is pointless... required to register on a blog i'm only going to post once... yeah waste of my time and reduces people posting cause they cant be stuffed registering

Re:What this shows us

[Anonymous Coward]

I'm sorry to tell you, but you do not seem to understand the concept of one-time hashes. The passwords are not encrypted but hashed. They are not decrypted either. They get cracked by hashing password candidates and seeing if the hash matches any password hashes in the list.

Of course, anybody who reuses passwords of important accounts is a retard anyway.

Re:What this shows us

[Em Adespoton]

Very interesting too that these passwords were obtained by decrypting the password file. So if you had a very complex and secure password, these guys now know what it is. If you used that same password on a site you care about, maybe with a different digit on the end, you've potentially lost a bit of security elsewhere. But if your password on gawker sites was "password" and you only used that on other fluffy sites, then you haven't lost that much.

They didn't decrypt all the passwords; their attack method only found the 200 "low hanging fruit" passwords. So if you had a very complex and secure password, it's still complex and secure-ish -- but now everyone knows the hash, linked to your email address.

Isn't it obvious?

[BStroms]

No matter how tech savvy the group of users, isn't it all but a given that most common passwords will be weak ones? There's always going to be a subset of users that just use simple passwords. More interesting would be a comparison of what percentage of the users had these weak passwords compared to other, less tech oriented sites.

Strong password are unique, weak passwords are not

[kiwix]

Of course the most common passwords are weak, the strong passwords are unique...

"the savviest on the Web"

[Anonymous Coward]

Readers of Gizmodo, Lifehacker and other Gawker Media sites may be among the savviest on the Web

Um... Using a web browser, lusting after phones, and reading about legal disputes between consumer electronics companies does not indicate that someone will choose a good password. If reading that junk is correlated with intelligence, surly that correlation is not positive.

2 characters??

[TheL0ser]

I just skimmed TFA (sorry), and I saw the graph of length vs email provider. And there's a blip on the 2 character mark. How does a 2 character password get allowed?

I guess in a way it works, though. Who's going to guess a 2 character password to try to get into an account?

Re:2 characters??

[delinear]

Could be a development/testing thing - we often use weak passwords to test functionality for accounts that only have access from restricted IPs, just because it's quicker and easier to type. I don't know if they verified the two digit password account or not, really if it is a dev thing it should have been removed from the live database but if it's locked down in the way I mentioned it wouldn't necessarily do any harm. On the other hand I have seen live applications that only do client-side JavaScript verification for string length, etc and therefore would allow one or potentially even zero character passwords if you sign up with JavaScript disabled, so I wouldn't rule anything out...

I use a stupid password for stupid sites

[gurps_npc]

When I create a profile for something like the Discovery Channel's forum, I don't care if someone hacks my account. It has no financial information and I am only using it to comment on Mythbusters.

The idea that a password is neccessary for such an account is idiotic. No one cares about hacking it (or if you do, then you have an unhealthy obsession with TV).

Gawker is a similar timewaster. Wasting your brain power to create/remember a good password for it is foolish.

I see nothing wrong with using "123456" or "password" for it. I am also pretty sure that most intelligent people that use stupid passwords for stupid web sites, don't use stupid passwords for their bank account or their primary email (but maybe for an email they feed to spammers that offer 'deals' if you give them your email.)

Re:I use a stupid password for stupid sites

[Attila Dimedici]

That is exactly what I was thinking. If for some reason I went to Gawker and registered an account, I would use a really easy, simple password because I don't care if someone hacks my account there. I'm not going to put any information in that account that you could use to hack my important accounts.

Re:I use a stupid password for stupid sites

[trollertron3000]

Agreed, I have a "throw away" password I use for accounts I don't care about. I only use this password(s) on sites or apps I don't really care much about. My bank password on the other hand.. yeah good luck guessing that. Okay you got me, it's asstastic.

Re:I use a stupid password for stupid sites

[poetmatt]

if there's an email address linked, then expect that email address to be tested across hundreds of sites and then they can rainbow attack sites that validate your email address (it's easy enough to do).

Basically, signing up with a legitimate email address is a huge mistake.

Re:I use a stupid password for stupid sites

[John Hasler]

Wasting your brain power to create/remember a good password for it is foolish.

I find that typing "pwgen -s" and copying one of the random passwords that result requires very little of my brain power. Your brain may vary. Of course, I also write down all of my passwords[1]...

[1] Except my GPG passphrase, of course. That has never been written down anywhere.

Re:I use a stupid password for stupid sites

[GIL_Dude]

So, in your example, let's say you "don't care" that your account on Discovery's MythBusters forum is compromised and don't bother to change your password. Now "you" (or rather your account) threatens Grant, stalks Kary, and requests myths about gay midgets child porn. Now, obviously you didn't do it yourself. But it could make your life uncomfortable for awhile.

I do hope that all of the folks (not just the OP - there are many in this thread) that are saying "it doesn't matter, I'll just get another account if I want to use the service again." think about this and take steps to get the password changed or the account deleted.

Re:I use a stupid password for stupid sites

[antdude]

So people can use your account to pretend to be you and saying bad things?

Re:I use a stupid password for stupid sites

[gurps_npc]

1. Writing down your passwords is far worse than what I do. Better to use a stupid password that requires someone that I know (and likely to want to impersonate me) to figure out a method of testing all the stupid passwords, than writing it down and having a room-mate/girlfriend happen across it one day. Sure they may not use it right away, but what if you get into a fight... 2. Writing down a password is more effort than I am willing to use for something like Discovery channel.

Re:I use a stupid password for stupid sites

[Cro Magnon]

Um, yeah that wasn't me. Someone else said all that under my account. Honest!

Re:I use a stupid password for stupid sites

[pete's-brain]

regardless, i'm changing mine. "monkey" is obviously overused. best move to something safer. like "batman"!

-----
petes-brain.com - is anybody home?

Re:I use a stupid password for stupid sites

[Anonymous Coward]

(but maybe for an email they feed to spammers that offer 'deals' if you give them your email.)

C'mon, just use http://mytrashmail.com/

Re:I use a stupid password for stupid sites

[low profile]

Someone may want to hack you innocuous account so they can post something: -- libelous -- embarrising -- obnoxiious -- illegal -- covertly embedded in the message ... and you will get the blame for it. trustno1

Re:I use a stupid password for stupid sites

[The Wild Norseman]

1. Writing down your passwords is far worse than what I do. than writing it down and having a room-mate/girlfriend happen across it one day. Sure they may not use it right away, but what if you get into a fight...

2. Writing down a password is more effort than I am willing to use for something like Discovery channel.

I write down my passwords, too. And by "write down" I mean "KeyPass."

Re:I use a stupid password for stupid sites

[Anonymous Coward]

I do hope that all of the folks (not just the OP - there are many in this thread) that are saying "it doesn't matter, I'll just get another account if I want to use the service again." think about this and take steps to get the password changed or the account deleted.

For stupid websites, like Gawker, why do I care if my account in compromised? It won't make life hard for me unless I put in valid personal information. Why would I use valid information? For places like that I generally create a new account every time I want to comment because I can't remember what I did before

Re:I use a stupid password for stupid sites

[Em Adespoton]

Actually, it's unlikely that your account would do all those things. More likely, your account would start posting links to various places that contain drive-by bot infectors. If you've been posting for a while somewhere, your ID has gained credibility, so the links will show up in Google searches, etc. and people will be more likely to click them... and become part of a botnet.

Re:I use a stupid password for stupid sites

[Anonymous Coward]

Or you register a domain and use email addresses that are unique to a given site within that domain.

So I could register, say, aardvark.org; create the subdomain throwaway.aardvark.org; and then use the email address gawker@throwaway.aardvark.org to register.

Why do this? Some sites insist on emailing initial passwords to you, so they "know" they have a legit email address. So this way, you give them a short-term legit email address, get what you need, then ditch it. Sure, there are public sites that will do this too, but if they care enough, they can block those ... they can't really block personal domains though.

Re:I use a stupid password for stupid sites

[gringer]

Spamgourmet is useful as well. You can set a maximum number of emails that you want to receive sent to a particular email address.

Re:I use a stupid password for stupid sites

[poetmatt]

bingo. I haven't used anything other than spamgourmet to register for things for years, and boy has it shown that amazon is pure fucking evil and full of spam.

meanwhile, you can send an outbound email from the spamgourmet domain if necessary for email confirmations, as well.

Perfect example:

[gcnaddict]

One of my disposable passwords was exposed in the leak. (you can search the cracked list. my username is listed, along with a pass circa 2007)

and today after checking my lists, I realized that I used the same password on both Slashdot (frequented!) and Digg (haven't visited since v4). Whatever, I changed it on both of these sites. I didn't bother touching it on Gawker now that I know I can't trust them to actually understand password security.

Re:Perfect example:

[gcnaddict]

I should've probably explained that it's a perfect example because that pass was one I used for sites such as these three (gizmodo, slashdot, digg) where losing the account wouldn't be terribly detrimental. Every other site for which I have an account uses a different pass per site.

Re:Perfect example:

[clone52431]

you can search the cracked list

Link please?

Re:Perfect example:

[bhcompy]

Exactly. I have different classes of passwords for different classes of sites. If my easy Slashdot password is compromised, nothing of value is lost, and no one gets the password to my bank account in the process.

Re:Perfect example:

[gcnaddict]

Check TPB for Gawker.

Re:Perfect example:

[clone52431]

Never mind, I found it:

http://www.slate.com/id/2277768/

Re:Perfect example:

[stupidfoo]

Check TPB

Re:Perfect example:

[butalearner]

If you want to check yourself, head to this Google Fusion table

Instructions are right there on the page, but you take the md5sum of your email address (e.g. "echo -n email@address.com | md5sum") and check it against the list (click "Show Options" and selected MD5 = . This doesn't mean your password was decrypted, but at the very least the encrypted version is out there. You can check this other Google Fusion table for your password.

Re:Perfect example:

[butalearner]

check it against the list (click "Show Options" and select MD5 = [your md5 hash here]).

Fixed that for me.

Re:Perfect example:

[Anonymous Coward]

Thanks - that is the link I needed. It's funny; I never trusted Gawker for some reason and never created an account. On the few occasions where I wanted to post something I used my Facebook login. It feels really odd to say this, but using facebook kept me more secure. My account is not part of the leak (I did check my facebook account there, but of course Gawker never knew the password on that account and it wasn't in the leak).

Re:Perfect example:

[JackieBrown]

I use lastpass and have a random password generated for every site I visit. I don't even think about passwords anymore.

Re:Perfect example:

[Zencyde]

Thanks for this. Just found out I was affected without having to grab the torrent. Exactly what the description on the table says. :P

Re:Perfect example:

[Anonymous Coward]

All my porn site passwords only use keys on the left side of the keyboard only so I can type them quickly one-handed.

Re:Perfect example:

[CYDVicious]

Do you use a left handed mouse too?

Re:Perfect example:

[apoc.famine]

You can't beat Godiva chocolate for password security. They save it in plaintext. If you forget it, they send you your password in an email.

It was a bit of a shock to get an email from them with my username, email, and pasword all in plaintext. Glad I used a horribly insecure, throwaway one. That, at least, made me happy.

Re:Perfect example:

[Khyber]

Nope, he uses his thumb on the trackpad!

Re:Perfect example:

[Macgrrl]

Well, you wouldn't want to let something like account security get in the way of getting your hands on chocolate.

Re:Perfect example:

[apoc.famine]

While I lack a second X chromosome, I have to admit, Godiva has some damn good chocolate.

Had I a severe chocolate addiction, I'd be likely to ignore their complete lack of security. As it is, I'm glad I'm a paranoid freak when it comes to passwords on the internet. Seeing a password and email address and login all in plaintext is scary as hell. If any of the three could have been used anywhere else, I'd have been really worried. Again, glad I'm a paranoid freak..

Re:Perfect example:

[Anonymous Coward]

It's even better to just remember a single master password and use that + url to hash a password on the fly. This way your passwords aren't stored anywhere other than your brain, you can always recreate them and you don't need to run any external applications.

Password Hasher for Opera
Password Hasher Plus for Chrome
PasswordMaker for Firefox

Get a LIFE!

[Frosty Piss]

Depends on whether you meticulously memorize or keep a record of dozens of passwords...

No, I don't. I use the same password /UID for *EVERY* bullshit site that really doesn't matter that much but I want to see the "subscription" content. And yes, I don't care if people know the UID / PASS to the bullshit sites that really doesn't matter that much but I want to see the "subscription" content. Folks, it's Gawker. If you're stressing over the disclosure of your Gawker UID/PWD, you seriously need to get a life.

Re:Get a LIFE!

[MichaelKristopeit309]

is slashdot a bullshit site?

do you cower on *EVERY* site?

what are you afraid of?

you're completely pathetic.

What the hell does it matter?

[DNS-and-BIND]

What the hell does it matter which password I use for a throwaway comment account on some website? Honestly. Oh noes, someone guessed my password...and...logged in as me? Big deal. "And nothing of value was lost"

I suppose there are those whose lives and self-worth are determined by the snarky and cruel comments they make online, but I suppose such persons would use a for their highly valuable commenting account, without which their lives would have no meaning.

Re:What the hell does it matter?

[Anonymous Coward]

What the hell does it matter which password I use for a throwaway comment account on some website?

In that case, what's your slashdot password?

Re:What the hell does it matter?

[thePowerOfGrayskull]

On the other hand, there are people who comment with their real names (I tend to , outside of /. - though even here my name is linked). If comments started showing up under my name that I didn't make, that could cause actual damages -- I'd hate for a search of my name by a potential employer to turn up goatse or something. (That's why I *do* tend to use a secure and different password for each site .)

Re:What the hell does it matter?

[John Hasler]

What the hell does it matter which password I use for a throwaway comment account on some website? Honestly. Oh noes, someone guessed my password...and...logged in as me? Big deal.

The "big deal" is that the site admins will now have to deal with the resulting comment spam.

Re:What the hell does it matter?

[DNS-and-BIND]

Spammers just register throwaway accounts themselves. Captchas a problem? Hire Indians to solve them. I got plenty of those on my old website.

Relivant? Really?

[Anonymous Coward]

I am not sure how useful this data is to be honest. Sure it is nice to glean some information regarding passwords, but the hotmail information was by far more useful. I protect my email passwords better than an account used to post comments. They have different passwords and if someone really gets a hold of my account for gawker, considering the only ID it is my is my email address, I am not too worried. So even if my password is 123456 it isn't a truely representative sample of what goes for important passwords.

Now if this was done for a bank, I'd love to see the results.

hunter2 did not make the list?

[eudas]

http://www.bash.org/?244321

Different Passwords

[TheNinjaroach]

I keep different passwords for my accounts based on their importance. Slashdot, Reddit, forums, IM, etc get a weaker password that's easier to remember.

Banks, insurance, work, email and the like get much stronger passwords.

If someone were to compromise my password on a less important site, who cares? I certainly don't.

Re:Different Passwords

[JamesP]

Exactly

I have 3 levels of password security. "Stupid sites" get the simpler password.

Also, for simple sites that I don't trust I have yet another password (simple as well, but different)

How to interpret the data

[Junior J. Junior III]

Ok, so we know there are a lot of accounts created for a public web site that have weak passwords.

Do we know that these accounts were "serious" accounts, and not throwaway accounts?

It could be, and likely is, that people don't care as much about securing their accounts as they should. It could also be that a lot of people needed to log in to gawker to access something one time, didn't plan to ever return, went through the account creation process with a throwaway password that they didn't care about, and then abandoned the account.

The proportion of people who are too stupid to own a computer is equal to the proportion of gawker users with weak passwords, less the number of throwaway accounts with weak passwords, divided by the total number of gawker users.

consider what was being "secured"

[dAzED1]

I have a weak password I use at a lot of silly blog and news sites, short of two such sites (this one and fark...) that is just a trash thing. I don't use the same password at multiple places - duh - short of this weak password. I'm not going to remember dozens and dozens of passwords, and I don't put real info on that type of site anyway. I mean seriously...it's a celebrity gossip site. I just went there for probably the third time in my entire life, top story:
The golden couple of Disney breaks up on Vanessa's 22nd birthday. Katie Couric goes to a Bieber concert. Michael C. Hall divorces. Miley barters for her bong video with Macbooks. Tuesday gossip is always a trade-off.
I mean hell, I wouldn't even use my real name or my established nick on a site like that. What the hell does it matter what the password is, at that point? I very minimal amount of security simply to allow for a very minor amount of distinction between posters, but if it's lost...
Anyway, the passwords used there shouldn't really be held against someone - just sayin.

Re:consider what was being "secured"

[Anonymous Coward]

Gawker is a shitty celeb gossip site. Gawker Media, however, is a massive internet news conglomerate and they own Gizmodo, Kotaku, Jalopnik, and io9, among others. Those passwords were compromised too.

Re:consider what was being "secured"

[Anonymous Coward]

Well, gawker also contains

Gizmodo - sucks, find better.
Kotaku - sucks, find better.
Lifehacker - occasionally ok
io9 - this one is pretty ok.
jezebel - for the ladies, they seem to like it.

I avoid gawker crap because their brand of "journalism" is usually below Fox News standards, but it's not just a gossip blog.

Re:consider what was being "secured"

[snowgirl]

Michael C. Hall divorces.

zOMG! You mean I have a chance again?! Sweet! ... ..

.

I mean, I don't care about gossip.

People still use "password"?

[KublaiKhan]

Someone needs to build an open-source authenticator that provides strong (not DES, FFS) password-mangling, easy interoperability with most common systems, and which rejects, logs, and unleashes attack dogs on anyone who tries to use "password" as a credential.

Re:People still use "password"?

[Anonymous Coward]

The best option is not to use services that asks for a password... I am posting as anonymous for obvious reasons...

Re:People still use "password"?

[muphin]

or add OpenID support to their website.

Holy Crap

[Anonymous Coward]

- that's the combination to my luggage

Not the indicator of savvy

[Anonymous Coward]

People may use crappy, easy to remember passwords on numerous news sites and blogs that they read. This doesn't tell anything about the quality of passwords the same people use on banking sites.
Posting anonymously for security reasons :)

Important things to note.

[Demonantis]

People that use msn and yahoo are lovers not haters and people that use gmail have a strange interest in cheese. On a side note, shouldn't the passwords be salted so they can't be brute-forced this easily. That is really the only thing that scares me. Everyone gets hacked. It just happens, but not having active damage mitigation beyond encrypting is just stupid especially simple ones like salting.

Whats with the Names?

[Quantus347]

What gets me is how many people used "Michael," "Michelle", and "Jordan". Why are those three names so popular for passwords?

Re:Whats with the Names?

[clone52431]

Michael Jordan and Michelle Obama, I guess.

Re:one, two, three, four, five...

[inerlogic]

that's the same reply i use on my luggage!

And the reason is

[saikou]

that people probably don't care if someone steals their "commenting" account password.
The only reason to create it in a first place was because they just wanted to show their nick.

I bet if someone checked Washington Post account database passwords, there'd be the same amount of "Blahblahs" and "F*ckoff123"

Re:And the reason is

[at_slashdot]

and a lot of "bugmenot"...

Re:And the reason is

[Anonymous Coward]

Yeah, that's probably what people are thinking. I thought that way very briefly (for about 5 minutes), then decided I still wanted a nominally strong password on even Internet Forum accounts, because I don't ever want to sit in an interrogation room at a police station or federal building, trying to explain that it WASN'T ME that posted that [kiddie porn/terrorist manifesto/ransom note/etc] on the Internet.

Re:And the reason is

[hsmith]

Exactly. The real problem is every stupid site in the world wants you to "create an account" for no reason at all. No thanks.

Oblig. xkcd [Re:So what?]

[Geoffrey.landis]

Most people tend to use the same username and password for every site they register on, and their email.

Obligitory xkcd here: xkcd.com/972

Here's what [Re:So what?]

[Geoffrey.landis]

Seriously, what are "hackers" going to do with my account? It's not even under my real name.

In answer to your question: they will post links to spam and malware.

Re:Here's what [Re:So what?]

[Anonymous Coward]

Not likely, most will simply sign up for their own free accounts.

This is why I use tiered passwords.

[gman003]

I use a system I call "tiered passwords". Since there's no way I can remember 20+ unique passwords for all the things that require them, I split them into tiers. Bottom tier is stuff I really don't care if you steal - I use it for Imageshack, Gawker, /., etc. Middle tier is the more important ones - I don't like you using it, but it won't ruin my life if you get access. That's a slightly more complex password (9 characters instead of 6), and I use it for my user-level computer accounts, GMail, etc. Finally, my top-tier accounts are for things that would really be terrible if someone were to get access: my root account and my bank account. That's a 20-character password, pretty much uncrackable unless the NSA gets involved.

This way, I have damage control. If something gets compromised, it's not going to affect as much. Gawker gets hacked, I change my password for a dozen websites, but don't have to worry about my email being stolen or my bank account being drained. Likewise, if someone does manage to hijack my email account, I can tell people over Facebook that it happened, and not to trust that email address anymore. Yes, it's still not as secure as unique passwords for every site, but it's significantly easier on the memory.

Re:This is why I use tiered passwords.

[horza]

Same system I used when I was younger. Nowhere near as good as using KeePassX, which will run on nearly every OS, from USB, and on mobile phones. Each and every site login has a unique password, like "xY5C=r%|yH`", and when I want to log in I just select "copy password to clipboard" over the entry and paste in. Also helps avoid keyloggers. You have one master password, and simply make sure you back up your encrypted password file.

This way, if a site is compromised then it has no damage outside of that account.

Phillip.

Re:This is why I use tiered passwords.

[Anonymous Coward]

That's a 20-character password, pretty much uncrackable

Famous last words!

Re:This is why I use tiered passwords.

[clone52431]

I just select "copy password to clipboard" over the entry and paste in. Also helps avoid keyloggers.

A keylogger that doesn’t monitor the clipboard? Lame...

Re:This is why I use tiered passwords.

[Anonymous Coward]

Finally, my top-tier accounts are for things that would really be terrible if someone were to get access: my root account and my bank account. That's a 20-character password, pretty much uncrackable unless the NSA gets involved

You are stating in public that you use a single , though long, password for all of your important accounts. Consider for a moment that if one of those is compromised, say by a corrupt bank IT person, then they have the key to all your other important sites.

I'm not saying this isn't common, I'm just saying that it introduces a substantial vulnerability.

Re:This is why I use tiered passwords.

[SirMasterboy]

What about remembering one base password and also making up your own mental hash function to use to hash your base password and the url of the website you are logging into. you only need to remember 2 things. Your base password and how to alter it per website. This way you have unlimited unique passwords for now and for forever.

Re:This is why I use tiered passwords.

[gman003]

That sounds like a very interesting idea. I might try something like that, but only with a very simple hash. Such as appending a 2-letter abbreviation of the site to the password, eg. "swordfish" becomes "swordfishsd", "swordfishfb", "swordfishgm" for /., Facebook and GMail, respectively.

Re:This is why I use tiered passwords.

[Anonymous Coward]

Problem with losing your email goes far beyond someone impersonating you. Email is used for password recovery just about universally, so no matter how secure that bank password is, having your email compromised can compromise the bank account (they perp just submits a "forgot password / password reset" request with your email.)

Re:This is why I use tiered passwords.

[VortexCortex]

I would place your e-mail addresses into tier 1. If someone compromises your e-mail, they can go to your bank's (or other tier 1 site) and request a password-reset via email.

I created a Bookmarklette I call "Master PassHash". It takes the top 2 levels of the current domain, such as "it.slashdot.com" only yields "slashdot.com".

It then asks for you master password, performs a concatenation & SHA-1 hash. There's your password.
Use the same "master password" on all sites, you get a different SHA-1 hash for each site. The downside is that some places have stupid limits like: Must have only 13 chars, or Must contain a symbol... (sometimes this is an indication that those sites are not hashing your password), and also: somewhere.co.uk == co.uk, (doh).

Here it is: (forgive me, those that are uninterested).

javascript:var%20hex_chr%3D%220123456789abcdef%22%3Bfunction%20hex%28num%29%7Bvar%20str%3D%22%22%3Bfor%28var%20j%3D7%3Bj%3E%3D0%3Bj--%29str+%3Dhex_chr.charAt%28%28num%3E%3E%28j*4%29%29%260x0F%29%3Breturn%20str%3B%7D%3Bfunction%20str2blks_SHA1%28str%29%7Bvar%20nblk%3D%28%28str.length+8%29%3E%3E6%29+1%3Bvar%20blks%3Dnew%20Array%28nblk*16%29%3Bfor%28var%20i%3D0%3Bi%3Cnblk*16%3Bi++%29blks%5Bi%5D%3D0%3Bfor%28i%3D0%3Bi%3Cstr.length%3Bi++%29blks%5Bi%3E%3E2%5D%7C%3Dstr.charCodeAt%28i%29%3C%3C%2824-%28i%254%29*8%29%3Bblks%5Bi%3E%3E2%5D%7C%3D0x80%3C%3C%2824-%28i%254%29*8%29%3Bblks%5Bnblk*16-1%5D%3Dstr.length*8%3Breturn%20blks%3B%7D%3B%0Afunction%20add%28x%2Cy%29%7Bvar%20lsw%3D%28x%260xFFFF%29+%28y%260xFFFF%29%3Bvar%20msw%3D%28x%3E%3E16%29+%28y%3E%3E16%29+%28lsw%3E%3E16%29%3Breturn%20%28msw%3C%3C16%29%7C%28lsw%260xFFFF%29%3B%7D%3Bfunction%20rol%28num%2C%20cnt%29%7Breturn%28num%3C%3Ccnt%29%7C%28num%3E%3E%3E%2832-cnt%29%29%3B%7D%3Bfunction%20ft%28t%2Cb%2Cc%2Cd%29%7Bif%28t%3C20%29return%28b%26c%29%7C%28%28%7Eb%29%26d%29%3Bif%28t%3C40%29return%20b%5Ec%5Ed%3Bif%28t%20%3C%2060%29return%20%28b%26c%29%7C%28b%26d%29%7C%28c%26d%29%3Breturn%20b%5Ec%5Ed%3B%7D%3Bfunction%20kt%28t%29%7Breturn%20%28t%3C20%29%3F1518500249%3A%28t%3C40%29%3F1859775393%3A%28t%20%3C%2060%29%3F-1894007588%3A-899497514%3B%7D%3Bfunction%20calcSHA1%28str%29%7Bvar%20x%3Dstr2blks_SHA1%28str%29%3Bvar%20w%3Dnew%20Array%2880%29%3Bvar%20a%3D1732584193%3Bvar%20b%3D-271733879%3Bvar%20c%3D-1732584194%3Bvar%20d%3D271733878%3Bvar%20e%3D-1009589776%3Bfor%28var%20i%3D0%3Bi%3Cx.length%3Bi+%3D16%29%7Bvar%20olda%3Da%3Bvar%20oldb%3Db%3Bvar%20oldc%3Dc%3Bvar%20oldd%3Dd%3Bvar%20olde%3De%3Bfor%28var%20j%3D0%3Bj%3C80%3Bj++%29%7Bif%28j%3C16%29w%5Bj%5D%3Dx%5Bi+j%5D%3Belse%20w%5Bj%5D%3Drol%28w%5Bj-3%5D%5Ew%5Bj-8%5D%5Ew%5Bj-14%5D%5Ew%5Bj-16%5D%2C1%29%3Bt%3Dadd%28add%28rol%28a%2C5%29%2Cft%28j%2Cb%2Cc%2Cd%29%29%2Cadd%28add%28e%2Cw%5Bj%5D%29%2Ckt%28j%29%29%29%3Be%3Dd%3Bd%3Dc%3Bc%3Drol%28b%2C30%29%3Bb%3Da%3Ba%3Dt%3B%7D%3Ba%3Dadd%28a%2Colda%29%3Bb%3Dadd%28b%2Coldb%29%3Bc%3Dadd%28c%2Coldc%29%3Bd%3Dadd%28d%2Coldd%29%3Be%3Dadd%28e%2Colde%29%3B%7D%3Breturn%20hex%28a%29+hex%28b%29+hex%28c%29+hex%28d%29+hex%28e%29%3B%7D%3Bvar%20salt%3D%27Tastes2Salty%27%3Bvar%20h%3D%27none%27%3Btry%7Bh%3Dlocation.host%3Bl%3Dh.split%28%27.%27%29%3Bwhile%28l.length%3E2%29%7Bl.splice%280%2C1%29%7D%3Bh%3Dl.join%28%27.%27%29%3B%7Dcatch%28e%29%7B%7D%3Bvar%20pw%3Dprompt%28%27Master%20Password%27%29%3Bif%28pw%29%7Balert%28%27Site%3A%20%27+h+%27%5Cn%5CnPassword%3A%5Cn%27+calcSHA1%28h+salt+pw%29%29%3B%7D%3Bvoid%280%29%3B%0A

Set that as the Location / URL of a bookmark. Click the bookmark while you are on a site, or paste it into your address bar to see it in action. Note: IE has short URL limits, and so will not work with this... you can fetch it with a stub then eval() it (which is what I actually do).

You might want to change the salt too (I did before posting, but hey, it's more secure if your salt is unique. hint: s/Tastes2Salty/yourOwnSalt/)

Actually, I use a bit more complex script that performs HMAC, outputs in Base64, contains an encrypted table of domain password limits/quirks/number of levels (to avoid the co.uk thing), and can re-generate itself in a new window (+GUI to

Re:This is why I use tiered passwords.

[Anonymous Coward]

> Since there's no way I can remember 20+ unique passwords for all the things
> that require them, I split them into tiers

Why are you trying to remember 20+ passwords? Software such as Password Safe will allow you to use a strong password for EVERY site, and you only need to memorise one strong passphrase.

Re:This is why I use tiered passwords.

[neminem]

Because if someone compromised a password to an important account on one site, they wouldn't *already* try the same password at other sites? You could argue that using the same password multiple places is a vulnerability (true, though everyone still does it.) But admitting to it, not so much. (Since, as mentioned, everyone does it.)

Savviest?

[BaronHethorSamedi]

Readers of Gizmodo, Lifehacker and other Gawker Media sites may be among the savviest on the Web...

What are you basing that on?

Re:Savviest?

[Xtifr]

Hey, it could be true. And some 9th century peasant who spent his entire short life standing behind an ox may have been the most gifted mathematician the world has ever seen. We'll never know.

I'm sure I can't be the only one thinking...

[Liam Pomfret]

...that there's an academic article or two to be written on this. A dataset like this would be particularly valuable to research on consumer privacy/security behaviours. Of course, that's assuming one could get it past the ethical review committee...

Dark Helmet

[e3m4n]

Dark Helmet: So the combination is... one, two, three, four, five? That's the stupidest combination I've ever heard in my life! The kind of thing an idiot would have on his luggage!

passwords inherently suck

[mattdm]

Many people (not necessarily us super-smart slashdotters, but in the media and in general) appear to be taking the wrong lesson from this. This data breech shows that it doesn't really matter how good your password is if the list is not stored securely.

In this case, they were encoded with the flawed and ancient "crypt" method, which allowed the weakest passwords to be brute-forced very quickly. But there's plenty of CPU power out there, and rest assured that any stronger passwords wouldn't stand up to further scrutiny, no matter how many squiggly characters are included.

Because of this, people using weak passwords that they didn't use elsewhere ("lifehack" is a prime example) are certainly better off than someone who had a "strong" password used on multiple sites.

Re:passwords inherently suck

[tibman]

Crypt isn't that flawed and ancient. It can also do blowfish, SHA512, and SHA256. You can also force a number of rounds too, to make hashing much more time consuming.

http://php.net/manual/en/function.crypt.php

Here is example code & output copied from that link:
if (CRYPT_SHA512 == 1) {
        echo 'SHA-512: ' . crypt('rasmuslerdorf', '$6$rounds=5000$usesomesillystringforsalt$') . "\n"; ...
Standard DES: rl.3StKT.4T8M
Extended DES: _J9..rasmBYk8r9AiWNc
MD5: $1$rasmusle$rISCgZzpwk3UhDidwXvin0
Blowfish: $2a$07$usesomesillystringfore2uDLvp1Ii2e./U9C8sBjqp8I90dH6hi
SHA-256: $5$rounds=5000$usesomesillystri$KqJWpanXZHKq2BOB43TSaYhEWsQ1Lr5QNyPCDH/Tp.6
SHA-512: $6$rounds=5000$usesomesillystri$D4IrlXatmP7rx3P3InaxBeoomnAihCKRVQP22JZ6EY47Wc6BkroIuUUBOov1i.S5KPgErtP/EN5mcO.ChWQW21

Re:passwords inherently suck

[mattdm]

I'm not sure if you're being pedantic, or obtuse, or whether you just don't know this, but generally, when someone talks about the crypt method of password encoding, they mean "the standard Unix DES-based algorithm" talked about in your link.

Re:passwords inherently suck

[tibman]

The difference is small to change the encryption method.

For example: echo crypt($password, $salt);
This does "standard DES" and also SHA-512.. with no change in syntax.

The change would be:
$salt = "$6$rounds=5000$usesomesillystringforsalt$"; //for SHA-512
$salt = "xy"; //for DES
$password = "123456";

I wasn't trying to be offensive or a know it all, just that i'm a bit of a php fan and enjoy discussing anything security related.

My fav topic being.. stripping the $salt from the resulting hash and NOT storing it with the hash in the database. Using the salt as a serverside password of sorts (non-random). So even someone with a six letter password would still have the protection of a crazy long password (as long as the salt could remain secret). But if the salt was copied along with the passwd DB, a rainbow table could be built.

If crypt is off-hand for DES.. my appologies.. i don't travel in any IRL linux circles. I was just trying to defend the poor ancient crypt lib, hah

Re:passwords inherently suck

[mattdm]

The function predates PHP 1.0 by about 20 years. :) PHP is no'

Re:passwords inherently suck

[mattdm]

(Pay no attention to the "PHP is no'" part of the above post. Awesome cut-paste-fail.)

No Salt?

[Anonymous Coward]

Make your password as complicated as you want, if the site is storing the passwords in plaintext or not salting its hash what difference does it make when the DB is exposed?

The more sensible users who know not to use the same password for commenting sites as say for example online banking will still be annoyed that their email address has been revealed to 1000s of spammers who will most likely value these over a list of passwords.

Bender says

[titanium93]

Where's Pimpmobile?

Also there is a starwars but no star trek?

Baseball beat Football

Football beat Soccer (redundant?)

Superman beat Batman

Jennifer beat Michelle

This means one thing: PLAINTEXT PASSWORDS!

[solaraddict]

Exposing the password list implies that the passwords were actually stored, in plaintext. Wtf, what year do people think it is, 1241? Plaintext passwords == passwords stolen from you sooner or later. One would have thought that after all this time - and it's been a long time - they would have learned by now.

Re:This means one thing: PLAINTEXT PASSWORDS!

[solaraddict]

Ok, I see "encryption" in the summary now - given that it was broken, stored passwords == plaintext passwords + 10 minutes of CPU time. Why does every dumb site need to store the damn passwords? It's not like they have to re-invent hashing, is it?

Re:This means one thing: PLAINTEXT PASSWORDS!

[Sancho]

At some point in Gawker's history, they switched to bcrypt hashes. The only problem is that people don't change their passwords a lot, so anyone who signed up before the change probably just had the old crypt(3) hash. crypt(3) is a hash, incidentally. It's just ... fairly easy to compute and run through with DES as the algorithm. The reason all of those passwords were exposed was because they were cracked, not because they were decrypted.

Modern methods of hashing use multiple rounds of hash in order to slow down a cracker. Computing 1000 rounds of bcrypt is trivial for the server when someone is logging in. It slows down the cracker significantly, though, since they're trying to crack many accounts with a large dictionary. This level of security doesn't seem to be as mainstream as regular hashes, though.

Re:This means one thing: PLAINTEXT PASSWORDS!

[Anonymous Coward]

The passwords are MD5 hashed into the account data, so they aren't stored as plaintext. The article specifically says that they haven't decrypted all of the passwords. Since this was a hash, most likely what they did was start generating the MD5 hashes for a bunch of passwords they thought would *probably* be used by users, then start comparing that to the hashes actually stored in the file.

So, they figured 123456 would be a common password, so they hashed it, then searched the data files for all occurences of that hash, and so on. Or, they just hashed every possible 1-6 character combination then started doing a compare (that gets pretty hard, pretty fast, after 6 characters, but they probably have a list of a few thousand 'passwords' which they feel are likely to be used by people for 6-8 character passwords - basically, you start to use dictionaries of english words, names of people, places, movies, books, fictional characters [e.g. lukeskywalker, darthvader, captkirk, etc.] ). As far as I know, they didn't really 'break' the encryption - this has *always* been a possible attack against hashed passwords. As others have said, if Gawker used salting, that would pretty much defeat even this, but Gawker apparently didn't.

It's also important to point out that all of this 'analysis' is basically run against only a subset of the user passwords database - the article says they are the "Top 50 Passwords", but in reality, it is the top 50 passwords that the people doing the 'analysis' were able to match against. The article graphics show that there were 188k user accounts, but the graphics only show passwords for something like 7 or 8 thousand of the accounts, so they've 'cracked' less than about 5 percent of the passwords of all users - the *weakest* 5 percent. It's probably true that those do represent the "top 50", because there is probably very little duplication of passwords among the remaining 180k or so user accounts - but there is at least the possibility there is a very popular password which they just didn't try yet.

Basically, those 8000 accounts represent people who didn't feel it was *worth* putting a strong password on that gawker media account, because it wasn't protecting anything important. I personally use a bit stronger passwords for online posting accounts, if for no other reason than that it could be really hard to explain to the FBI why kiddy porn or threats against other people, etc were posted on my account - that's not something I'd like to have to convince authorities or a jury was NOT ME, but someone who hacked my account. Still, I don't bother using very strong passwords for online commenting accounts.

Re:This means one thing: PLAINTEXT PASSWORDS!

[CyberDragon777]

At some point in Gawker's history, they switched to bcrypt hashes. The only problem is that people don't change their passwords a lot, so anyone who signed up before the change probably just had the old crypt(3) hash.

Why would you need co change the password for a hash algorithm change?

Use separate DB columns for the old and new hashes.

Modify your login code to:
If a new password hash exists for the account compare the password with that. Login if it matches.
If a new hash doesn't exist, but the old hash does, compare the password with that. If it matches, calculate the new hash for the password and store it. Remove the old hash from the DB and login.

After the active users migrate over to the new hash you can send an email to the unused accounts explaining that they need to reset their passwords because of a security update. Remove the column containing the old hashes and remove the second part of the login code changes.

People who use the site often wouldn't notice a thing.

Re:This means one thing: PLAINTEXT PASSWORDS!

[Sancho]

Fair point. I can imagine a line of thought that would lead to not doing this (mostly how the code is naturally separated) but it's not a very good one.

What's interesting to me is that some entries in the database had non-null values in both hash fields. I'm not sure if Gawker kept the old hash at a password change or what.

Re:This means one thing: PLAINTEXT PASSWORDS!

[gnapster]

Regarding whether this is really the "Top" 50 passwords: Maybe I'm missing something, but if they aren't using salt, then any two users who have the same password should have the same hash, right? So even without knowing what the passwords are, it should be possible to make a list of the top 50 hashes. If a password is found for each of those, then those should constitute a list of the top 50 passwords. Am I missing something?

Of course, this ignores what someone above mentioned, that the database may be partitioned into legacy crypt hashes and more secure bcrypt ones. There could be dozens of super-weak, duplicate, recently-entered passwords in the latter set which are safe and sound! And on the other hand, the whole methodology of the article is pretty casual and imprecise, so it is hard to know what is really going on.

I agree that it is in one's best interest to keep password-protected accounts secure, because you cannot anticipate the consequences of such breaches. What do you think of systems like Wordpress with Gravatar, which creates an identity based on name and email address, and provide no authentication except those details?

LastPass

[Straterra]

This is why I use LastPass to manage my passwords. I have one, completely randomly-generated password per site.

Re:LastPass

[Inigo Montoya]

I like LastPass too, but I think I will probably switch away from it and move to KeePassX even though I think that LastPass is slicker and better integrated with the browser than KeePassX is. I haven't used it for a while so maybe the situation has improved here.

The fear I have is that LastPass will go away, just like many other good web services that can't find a good business model and just disappear. I am currently also using Xmarks (previously FoxMarks) for syncing bookmarks across 3 Browsers and 4 laptops with dual-booting 2 different OSes. This has worked wonders. But Xmarks could not make money, and is going away in January. Instead of open-sourcing it all, they are just going away. All I can do is a final sync and export my bookmarks now, for importing into del.licio.us (is that how you spell it?) not nearly as good as Xmarks will ever be. I suppose I could run my own Xmarks server ( I think it's possible).

Anyways, I fear LastPass might die one day. Better to stick with an open source solution now.

Re:LastPass

[Straterra]

It's funny that you bring up Xmarks. LastPass recently purchased Xmarks, so it still lives. You might have to pay like $10 a year for it, but I still think thats a great deal. Hopefully, they give Xmarks for free to their premium users!

This is what happens.

[Anonymous Coward]

When you force users to make Yet Another Account.

so?

[shadowrat]

is there something important in a gawker account? Most of these accounts are a formality used to access the site. Usually when a news site asks me to sign up for an account, i put in some bogus information and an easy password. what are people going to do? log in and read articles under a name that nobody attributes to me anyway? um.....

Re:so?

[the eric conspiracy]

I imagine that since people reuse username/password combos information retrieved from Gawker might also be useful at a number of other sites that would be more interesting.

f---you

[april21wed]

I wonder wether the list is just anonymised or anonymised AND censored.

Re:one, two, three, four, five...

[Anonymous Coward]

God, this joke is really, *really* old. Yes, we know this is a password thread, but this doesn't mean we have to pull out an overused movie reference every time we have one.

Re:Strong password are unique, weak passwords are

[JackOfAllGeeks]

I'm not sure that follows.

If "strong" is defined as "this cracking software takes an ungodly amount of time to guess it," it's possible that a plurality of some tech-savvy community could have the same otherwise-random string of characters. Unlikely, but possible.

If only 200k of 1000k passwords were cracked, there's still the potential of some strong password being the most popular.

Similar analysis here

[thisisauniqueid]

Similar analysis here.

Gawker Passwords are Worthless

[simsong]

The fact that passwords like "12345" and "password" are the most comment on websites like Gawker (and rockyou) is simply evidence that:

1. People don't care about their accounts on these systems. It's okay if somebody takes it over.
2. People don't want to use their good passwords on these systems, because they know that these companies have poor security passwords.

I received an email notifying...

[WSOGMM]

I got an email from Gawker saying that my password was compromised and that I should change it. I don't even remember signing up for that website... Either I forgot... or my main email account has been compromised?

Re:I received an email notifying...

[Anonymous Coward]

I got two such e-mails, under similar circumstances (never, to my recollection, have I registered an account with them).

Then it occurred to me that I had posted on a blog that allowed anonymous comments, but required you to leave an e-mail address, and I had used those exact two e-mail addresses to do so. Apparently it was part of the Gawker network and they sent e-mails out to anyone who had posted a comment regardless of whether they had actually registered an account.

Intentionally trivial passwords should be used

[Peeteriz]

There are hundreds of websites that insist that I get an 'account' in order to use their intended functionality.

There is no way I can remember hundreds of different, secure passwords. Actually, there is no way to even reasonably remember my username if my 'default' one is occasionally taken on some websites.

Ergo, on sites such as gawker a trivial password should be used. Like, say, '123456'. And I still would have trouble logging in - I'd have to try 1-3 usernames until I find the one that works, and it's quite possible that I had created a couple other user accounts there some years ago but just forgotten about them, and after a few reinstalls and changed computers, the computer doesn't remember it either.

There is no way ever how I would have a secure password on something like gawker. Actually gawker shouldn't in any way require or expect the passwords to be secure. Noone should, except if you really, truly believe that your site has something that's worth enough for people to take seriously. Well, banks could do that. Maybe paypal. And maybe these who believe that they running most of your life, such as facebook or google. But 99% of the sites that require logins - you're just kidding yourself.

My memory capacity allows to reliably remember something like 3 decent, periodically changeable passwords. Two are taken up for work purposes, one is for my gmail/googleapps account. Your site most likely is not important at all, and if your password criteria disallows my usual 7-letter alphanumeric password that's the same for a hundred websites, then f*** you, i'll probably just click on the password reset link if I encounter your site and my browser doesn't log me in automatically. No forum or shopping site or 'community' or blog or game site or news site like slashdot is worth the mindspace to think about secure passwords.

Email should be *TOP TIER*

[Anonymous Coward]

You're forgetting something here: your email can be used to reset your other passwords.

In other words, your email password might as well be a master password. Please treat it as "top tier" and be more watchful, or you're in for a nasty surprise if a clever attacker uses it to take over your other accounts.

Of course 123456 is the most common passwords

[masterlogan2000]

Statistically this makes sense since as, even if only 10 people have this password, that's 9 more people that have a password of, say, "we2iru0sdfnsf283fsv72nfkdflhasdfj". Regardless of password strength and regardless of how strong of passwords Gawker requires its users to have, simplicity will always win the "top passwords" award. This is because it is hard for a complicated password to be replicated by multiple users. In other words, this article only gives me a starting point (which I can similarly find elsewhere on the internet) of passwords to try if I wanted to hack a Gawker (or any other) site.

How do you DES encrypt a password like gawker does

[Anonymous Coward]

My old account I never remembered the info for was in that list. I made the mistake of resetting my password before trying to guess some of the old account possibilities.

I know its not the same password I use for anything too important (email, banking, etc), but I'd still like to know what password is in that list.

Does anyone know how to des encrypt a password the way gawker does so that I can compare some passwords I might have used to the one in that list?

Re:How do you DES encrypt a password like gawker d

[Neil Jansen]

download John The Ripper, and use the command "john --format=DES mypass.txt", where mypass.txt is a file containing "jsmith::1001:1000:Joe Smith,Room 1007,(234)555-8910,(234)555-0044,email:/hom". Obtain your pw hash from the torrented file obviously.

I had the same problem, and found mine in 3 hours and 39 minutes -- DES is just plain easy to crack. Then had to spend a few more hours changing that password on ~50 forums and news sites.

Re:How do you DES encrypt a password like gawker d

[Neil Jansen]

Whoops, the mypass.txt got mangled.. It should contain "jsmith:(your PW hash here):1001:1000:Joe Smith,Room 1007,(234)555-8910,(234)555-0044,email:/home/jsmith:/bin/sh"

Simple Result

[cjb110]

of every damn site now needing a login to do anything.

Shopping sites are the worse, no I don't need an account, I want to buy this one item from you, oh no google checkout or paypal...well I'll go else where then.

metrix007 got PLAYED - he played himself.

[Anonymous Coward]

metrix007 is pissed about this http://yro.slashdot.org/comments.pl?sid=1888084&cid=34462614 where he blundered on hosts files. metrix007 got played. He played himself badly due to his skimming!