Top 250 cracked Gawker passwords

Re:Top 250 cracked Gawker passwords by JonnieCache on Thursday December 23, 2010 @07:19AM (#2034208)

consumer. Really? consumer?

Who self identifies with that horrible term so closely that they would use it as their password?

A lot more people than I thought evidently.

[ Parent | on HN ]

Re:Top 250 cracked Gawker passwords by jgrahamc on Thursday December 23, 2010 @07:36AM (#2034244)

They used to own consumerist.com and I guess these people chose the password consumerist and because the Gawker system silently truncates at 8 characters they got consumer.

[ Parent | on HN ]

Re:Top 250 cracked Gawker passwords by JonnieCache on Thursday December 23, 2010 @08:08AM (#2034297)

> the Gawker system silently truncates at 8 characters they got consumer.

I had forgotten that part of the whole sorry story. Reminds me of the uni I attended, (Sussex) where not only were passwords truncated, there was in fact a max length policy of 8 chars. This was across their entire campus network, and all intranet apps. Yeah, my degree ain't worth much.

[ Parent | on HN ]

Re:Top 250 cracked Gawker passwords by dagw on Thursday December 23, 2010 @09:03AM (#2034382)

My university had the same max length policy. The reason is that a few ancient legacy systems couldn't handle longer passwords and they wanted to make sure that your password could be used on all systems.

[ Parent | on HN ]

Re:Top 250 cracked Gawker passwords by JonnieCache on Thursday December 23, 2010 @09:14AM (#2034406)

My instinct in this scenario would be to use Bcrypt on the new systems, and then try and find some other hash function that came out to 8 chars for use on the legacy systems.

Can anyone with more experience point out whether I am in any way on the right track here?

EDIT: hmmm, the storage of the passwords as 8-char weak hashes would render the more secure hash function used on the modern systems irrelevant. Maybe use the output of the strong hash as the input of the weak hash? Would this be secure?

[ Parent | on HN ]

Re:Top 250 cracked Gawker passwords by qjz on Thursday December 23, 2010 @10:41AM (#2034666)

Truncation to 8 characters is an entropy killer; limiting the range of characters by using the truncated strong hash as the input will reduce it further. In a weak system, you're more likely to find a collision that will effectively substitute for the original password. For two such systems to coexist, you'd need to enforce the use of passwords greater than 8 characters to prevent a crack on the weak system from working on the stronger one.

[ Parent | on HN ]

Re:Top 250 cracked Gawker passwords by JonnieCache on Thursday December 23, 2010 @10:54AM (#2034719)

Thankyou. This is very interesting. Whenever I study cryptography I feel a bit like Alice going down the rabbit hole.

Thank god the safe best-practices are clear and simple in the majority of cases.

EDIT: in case anyone reading this is wondering, the safe best-practice is to USE BCRYPT.

http://codahale.com/how-to-safely-store-a-password/

[ Parent | on HN ]