Probably something like this: https://sunnia.medium.com/an-analysis-of-chinese-passwords-e...

"Liman1000" was #50

Is this a reference I'm not familiar with? Otherwise I wonder how much of her higher numbers (outside, say top 20) are effectively just noise

> Is this a reference I'm not familiar with?

Seems like it's a reference to AFU establishing themselves in Liman and 1000s of russian soldiers backing down? That's all I could find https://theins.ru/en/news/254974

And the table lists a time to crack it of 4 days. I assume that all of these will shortly be crackable in less than 1 second, as they'll be tried first.

How does a password cracker brute force against a password hash (say MD5 or SHA256, I know bcrypt is designed specifically for terrible brute force efficiency) if it has a random salt? Is the salt known and just uselessly stored with the password + easily retrievable during a login attempt or database leak?

The salt is typically stored as a prefix to the hash. Its job is not to be a secret, but to ensure that an individual effort must be made to crack each password. I can’t precompute and store the hashes or otherwise reuse previous work.

Another way to look at this is that the salt prevents information leakage from the hashes. Even if the same password occurs dozens or hundreds of times in the same database, unique salts will ensure that every hash is unique.