phc-discussions - Re: [PHC] How important is salting really?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 11 Dec 2014 19:44:41 -0800
From: epixoip <epixoip@...dshell.nl>
To: discussions@...sword-hashing.net
Subject: Re: [PHC] How important is salting really?

On 12/11/2014 7:31 PM, Ben Harris wrote:
>
> And from (https://xato.net/passwords/more-top-worst-passwords/)
>
>     4.7% of users have the password password;
>     8.5% have the passwords password or 123456;
>     9.8% have the passwords password, 123456 or 12345678;
>     14% have a password from the top 10 passwords
>     40% have a password from the top 100 passwords
>     79% have a password from the top 500 passwords
>     91% have a password from the top 1000 passwords
>
> Critically, 0.18% of users use 99.6% of the passwords in the database
> leaked in that article.

Mark Burnett is a friend whom I respect; however, his analysis does not
jive what we see in most password breaches. I'm not sure what data set
he used for this analysis, but it is not very representative of the real
world.