This is a fake news dude. Check this out: http://news.ycombinator.com/item?id=4678064

Not a single sentence, can it be that they allow characters like ( and % but not whitespace? Boggles my mind that people don't use more sentences.

Personally I don't like spaces because every now and then I find a service that doesn't accept them - ex: you can't have spaces in your IRC password. ASCII printable characters are enough for me.

Look at the difference in time when using a simple 'helloworld' password with and without spaces. https://www.grc.com/haystack.htm

Also, for some more reading on why using spaces will make it infinitely more difficult for hackers to try and gain access: http://www.baekdal.com/insights/password-security-usability

There's one ilovemydaughternancy with no spaces. Why would you want spaces?

There's also lovenancy18. Someone will have a long talk with his daughter.

Sentences are easier to remember. Yet grammatically correct sentences can give you things like capital letter, whitespaces and even periods.

Unfortunately, they also cut down on the search space quite a bit.

I find that typing a bunch of words with spaces is faster than with words. I guess my brain is wired by now to automatically press the spacebar between words.

Wouldn't it make it harder to remember which places accept a password with spaces and which don't? I already have trouble remembering which sites require long passwords and which require shorter ones.

to make it more natural to type a passphrase

What's wrong with 3 and 4?

It appears that, in general, the FBI staff are setting reasonable passwords. There are a few passwordNNN types but the majority are adequate and, in my opinion, would hold up well against a brute force vector, which is the primary purpose of password complexity.

The fact that some of those passwords appear very strong also means they weren't bruteforced and therefore most likely stored in plaintext. I guess even the FBI have sloppy programmers...

They say on the pastebin that one connexion sent passwords in clear text (through asipx-webadmin), so they probably were read there. At least it was probably an entry point.

3 and 4 would not take long to be brute forced by a dictionary attack, I think. Too many people use qwerty on their password, so it's probably high rated on a dictionary attack.

3 and 4 are weak because we have pretty good heuristics on how passwords are composed so it wouldn't take much longer to brute-force them than it would to do password123.

I'd be interested to see if either 3 or 4 appear on existing password dictionaries.

This one made me giggle:

> [email protected] - fraudadmin

I was also quite amused by: 12345678987654321