full-disclosure - Re: Large password list

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAExQ7u+3K8dbk7uQFF4EJP-za0kjXTOwJ4LvWwOY_Vwh9stEjQ@mail.gmail.com>
Date: Thu, 1 Dec 2011 20:05:40 -0600
From: adam <adam@...sy.net>
To: Benji <me@...ji.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: Large password list

Also, not to beat a dead horse, but..

>>- cover cost of upstream bandwidth, the list is currently at  64MB
compressed and new versions are likely to only get larger

Is also pretty ridiculous. Why? Because you're offering
hashes.txt<http://dazzlepod.com/site_media/txt/hashes.txt>
, passwords.txt <http://dazzlepod.com/site_media/txt/passwords.txt> and
uniqpass_preview.txt<http://dazzlepod.com/site_media/txt/uniqpass_preview.txt>
to
the world:

C:\Users\adam\Desktop>ls -la uniqpass_preview.txt | gawk "{print $5}"
19855177

C:\Users\adam\Desktop>ls -la passwords.txt | gawk "{print $5}"
17496649

C:\Users\adam\Desktop>ls -la hashes.txt | gawk "{print $5}"
22033538

C:\Users\adam\Desktop>echo 19855177 + 17496649 + 22033538 | bc
59385364

In total, 56MB and you're offering them for free and uncompressed.

C:\Users\adam\Desktop>zip -9 combined.zip passwords.txt
uniqpass_preview.txt hashes.txt
  adding: passwords.txt (164 bytes security) (deflated 60%)
  adding: uniqpass_preview.txt (164 bytes security) (deflated 38%)
  adding: hashes.txt (164 bytes security) (deflated 46%)

C:\Users\adam\Desktop>ls -la combined.zip | gawk "{print $5}"
31337317

Meanwhile, if you were compressing them: they'd be almost half the size.
But you're not, you don't even seem concerned with doing so, and you're
going to pretend that 8MB is really making *that* big of a difference? If
so, why are you wasting 27MB by offering those 3 files uncompressed? That
doesn't really make much sense to me.

On Thu, Dec 1, 2011 at 7:52 PM, Benji <me@...ji.com> wrote:

> Which country is "UNIQPASS" registered as a tm?
>
>
> On Fri, Dec 2, 2011 at 1:47 AM, adam <adam@...sy.net> wrote:
>
>> >>- reduce abuse
>>
>> The concerning part is that you're serious. Tell me, how does someone
>> paying for a list of STOLEN passwords reduce abuse?
>>
>> This email, your obsession with LulzSec and the disclaimer on your site
>> make it pretty clear where the information is coming from, so what kind of
>> abuse potential does this have by someone not paying? And who are you to
>> not only take credit, but also demand payment, for other peoples' efforts?
>>
>> I'm partly tempted to buy and post the list here just to spite you for
>> being so idiotic.
>>
>> On Thu, Dec 1, 2011 at 7:16 PM, Addy Yeow <ayeowch@...il.com> wrote:
>>
>>> There are many password lists already available for free out in the wild
>>> but mostly lack the quality.
>>>
>>> The minimal fee for UNIQPASS is necessary to help:
>>> - keep ongoing effort to improve the quality of the list over time
>>> - ensure frequent updates, i.e. when new leaked databases appear
>>> (existing users of UNIQPASS get updated copy for free)
>>> - cover cost of upstream bandwidth, the list is currently at  64MB
>>> compressed and new versions are likely to only get larger
>>> - reduce abuse
>>>
>>> On Fri, Dec 2, 2011 at 1:33 AM, Fabio Pietrosanti (naif) <
>>> lists@...osecurity.ch> wrote:
>>>
>>>> On 12/1/11 6:14 PM, Addy Yeow wrote:
>>>> > I thought some of you may find this large password list useful, over
>>>> 27
>>>> > million entries.
>>>> > http://dazzlepod.com/uniqpass/ (it's a paid list though, at $4.99)
>>>>
>>>> Anyone linking a warez version (Why pay $4.99?) ?
>>>>
>>>> -naif
>>>>
>>>> _______________________________________________
>>>> Full-Disclosure - We believe in it.
>>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>>
>>>
>>>
>>>
>>> _______________________________________________
>>> Full-Disclosure - We believe in it.
>>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>>> Hosted and sponsored by Secunia - http://secunia.com/
>>>
>>
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>
>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/