lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 11 Dec 2014 19:44:41 -0800
From: epixoip <>
Subject: Re: [PHC] How important is salting really?

On 12/11/2014 7:31 PM, Ben Harris wrote:
> And from (
>     4.7% of users have the password password;
>     8.5% have the passwords password or 123456;
>     9.8% have the passwords password, 123456 or 12345678;
>     14% have a password from the top 10 passwords
>     40% have a password from the top 100 passwords
>     79% have a password from the top 500 passwords
>     91% have a password from the top 1000 passwords
> Critically, 0.18% of users use 99.6% of the passwords in the database
> leaked in that article.

Mark Burnett is a friend whom I respect; however, his analysis does not
jive what we see in most password breaches. I'm not sure what data set
he used for this analysis, but it is not very representative of the real

Powered by blists - more mailing lists