Show HN: 5+ Billion Passwords in Order of Most Popular

Re:Show HN: 5+ Billion Passwords in Order of Most Popular by jacquesm on Sunday June 11, 2017 @04:25PM (#14533600)

I don't understand: Why do you assume that password checkers keep their lists in alphabetically sorted form rather than just to load the whole thing into a db table with an index on it?

[ Parent | on HN ]

Re:Show HN: 5+ Billion Passwords in Order of Most Popular by berzerk0 on Sunday June 11, 2017 @04:39PM (#14533676)

As I was looking around for the files to make this project, on SecLists, Weakpass, and Hashes.org, most of the files were in alphabetical order. This was especially true for the larger files.

[ Parent | on HN ]

Re:Show HN: 5+ Billion Passwords in Order of Most Popular by jacquesm on Sunday June 11, 2017 @05:13PM (#14533818)

Yes, but it doesn't matter what order they are in if you put them in a DB. I don't know anybody that would do a sequential scan over a file in production.

All you've done is shuffled around the most frequent cases to the beginning, which is great if that's what you are looking for, but now something else occupies the last slot and that case is just as bad as before.

The real solution is to see these files as input to an indexed table so that you can get to the entry you want in log(n) time.

[ Parent | on HN ]

Re:Show HN: 5+ Billion Passwords in Order of Most Popular by neuroid on Sunday June 11, 2017 @05:59PM (#14534026)

I don't know anybody that would do a sequential scan over a file in production

Well, that's pretty much how one would try to crack a password using a wordlist.

EDIT: If the goal is to crack a bunch of properly hashed (PBKDF2, scrypt, etc.) and salted passwords then a lookup table is not very practical.

[ Parent | on HN ]

Re:Show HN: 5+ Billion Passwords in Order of Most Popular by jacquesm on Sunday June 11, 2017 @06:11PM (#14534076)

If you're trying to crack 'a password' you're doing it wrong. Alternatively, you're doing something illegal.

That's not why these lists are made public (though I can appreciate the fact that they are 'dual use').

[ Parent | on HN ]

Re:Show HN: 5+ Billion Passwords in Order of Most Popular by edoceo on Monday June 12, 2017 @12:21AM (#14535183)

PP is talking about a lookup, you are talking about cracking. Different things. For lookup of a string match make an index.

[ Parent | on HN ]