Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Analyzing 20,000 MySpace Passwords

Posted by CmdrTaco on Sun Sep 17, 2006 08:15 AM
from the thats-kinda-scary dept.
Privacy Security
Rub3X writes "Author found 20 thousand MySpace passwords on a phishing site and did some tests on them. They were tested for strength, length and a number of other things. Also tested was the most popular password, and the most popular email service used when registering for myspace."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Analyzing 20,000 MySpace Passwords 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.
  • Site seems dead for know, but the Coral Cache [nyud.net] got the text atleast.

  • Author should have... (Score:5, Funny)

    by 10sball (80009) on Sunday September 17 2006, @08:20AM (#16124375) Homepage
    spent some of that time analyzing the strength of his hosting plan

  • 666 - myname (Score:5, Informative)

    by vrta (905538) on Sunday September 17 2006, @08:21AM (#16124378) Homepage
    Most common passwords used:
    13 - cookie123
    12 - iloveyou
    12 - password
    11 - abc123
    11 - fuckyou
    11 - miss4you
    • That's amazing! I've got the same password on my luggage!

    • Re:666 - myname (Score:5, Insightful)

      by rednip (186217) * <rednip.gmail@com> on Sunday September 17 2006, @08:48AM (#16124467) Journal
      Most common passwords used:
      Really, it should read: the most commonly used passwords, by MySpace users who were targeted by and fell for a phisher.

      • Almost (Score:5, Insightful)

        by benhocking (724439) <`moc.oohay' `ta' `gnikcohnimajneb'> on Sunday September 17 2006, @09:12AM (#16124546) Homepage Journal
        "Really, it should read: the most commonly used passwords, by MySpace users who were targeted by and fell for a phisher" - or by people pretending to be MySpace users when targeted by a phisher - or by people giving a bogus password when targeted by a phisher.

        • Re:Almost (Score:5, Insightful)

          by flooey (695860) on Sunday September 17 2006, @10:46AM (#16124841)
          "Really, it should read: the most commonly used passwords, by MySpace users who were targeted by and fell for a phisher" - or by people pretending to be MySpace users when targeted by a phisher - or by people giving a bogus password when targeted by a phisher.

          I'd imagine that's why fuckyou is up there so high. I sort of assume that's a message to the phisher rather than a real password.

            • Re: (Score:3, Informative)

              by devilspgd (652955) *
              It wouldn't do a ton of good since your average phisher has access to a ton of zombies they can verify a password list without triggering any IP:failedlookup ratio and banning themselves from the site.

      • Due diligence would have him write a script to check which user/pass combinations were valid, and then analyze only those.

        • Re: (Score:3, Interesting)

          by jandrese (485)
          Honestly, most of these pishing operations that I've seen are real lowbrow affairs. Proper engineering isn't exactly a common feature. Most of the time they don't care if 50% of the passwords (or more) don't work, all they need are a few hits to get what they need.
          • Well, yeah, if you're phishing for bank account info. What the hell is to be gained by hijacking MySpace accounts?

        • Re: (Score:3, Insightful)

          by TubeSteak (669689)
          Due diligence would have him write a script to check which user/pass combinations were valid
          I think we would call that "unauthorized access"

          Methinks most people would know enough to avoid publicly admitting to testing those l/p's.

        • Re:666 - myname (Score:5, Insightful)

          by Tanktalus (794810) on Sunday September 17 2006, @09:24AM (#16124586) Journal

          It depends on how smart the phisher is. If they take the password then redirect to the real MySpace account (to avoid arousing suspicions among even the gullable) where they can try again, there won't be many second-tries.

          If I were of low enough moral character to phish, that'd be what I'd do, anyway.

  • Interesting analysis, but... (Score:5, Insightful)

    by SilentChris (452960) on Sunday September 17 2006, @08:23AM (#16124382) Homepage
    It's a fairly interesting (if not too detailed) analysis. A commenter makes a critical observation, though: these were passwords entered at the phishing site, not MySpace. As such, some people can easily recognize it's not the original site and add such gems as "fuckyou".

    Personally, I try to fit the following in every eBay phishing page I see:

    Field 1: "just who do you think you're kidding?"
    Field 2: "better luck next time, dolt."

    • Re:Interesting analysis, but... (Score:4, Interesting)

      by Daytona955i (448665) <flynnguy24&yahoo,com> on Sunday September 17 2006, @08:57AM (#16124496)
      Also people who have stronger password probably would recognize it as a phishing site so the data is pretty much worthless. Also how many people went to the phising site, it's probably a small percentage of users.

      While the data is interesting, it really can't be used to determine anything other than the fact that some users have lame passwords.

          • Re: (Score:3, Interesting)

            by TheCarp (96830) *
            Nope, I actually use a mnemonic system to hel me remeber them

            Its funny how often I have to give someone "the stare" when they ask "whats your password"... but truth is, I couldn't even rattle it off if I tried. I learn the mnemonic and the muscle memory of typing it, but I don't know it character by character.

            I have to sit down for a sec and go over the mnemonic to remeber the individual chars.

            -Steve

  • Passwords from hacker site = biased. (Score:5, Interesting)

    by Vo0k (760020) on Sunday September 17 2006, @08:25AM (#16124393) Journal
    Say, 10% of passwords contained on a site was obtained using a dictionary attack. Then perform analysis on these password. Conclusion that basing on statistically significant number of passwords (10%, >10000) almost 100% of passwords on the site are vulnerable to dictionary attack is simply wrong - the sample was biased.
    Similar about phishing-originated passwords. Phishing is a result of bad practices on user side, and usually clicking attachments in spam, using insecure browser and no antivirus is connected with using poor quality passwords. The results WILL show worse quality of user passwords than real simply because the passwords originate from subset of users who know less of security in general (and as result, got hacked.)

  • Flawed (Score:4, Insightful)

    by schabot (941087) <s...chabot@@@gmail...com> on Sunday September 17 2006, @08:25AM (#16124394) Homepage
    The analysis is flawed as a general indicator of MySpace passwords because it is only a subset of people who would actually fall for phishing attacks. Of course such people will have horrible password habits

    Now, I am changing my password to cookie321, no one will see that coming.

    • Re: (Score:3, Informative)

      by tomhudson (43916)

      "Now, I am changing my password to cookie321, no one will see that coming."

      No, no - you have to change it to "wookie321". The glove won't fit, and Endor something or other ...

      Seriously, who even cares about the passwords to myspace. The "numeric strength" so-called "analysis" was screwed up. Since myspace requires a number in the password, a lot of people put their name and a digit or two after it as their account password. They also sometimes screw up their email address info, which is how you can end

      • Re:Flawed (Score:5, Insightful)

        by Zapman (2662) on Sunday September 17 2006, @10:31AM (#16124794)
        This is what it is. It's an analysis of passwords, obtained by a script kiddie's phishing site. The author makes no claims to 'analysing the strength of every myspace password' or some such. All the information you need to analyze his results are right there.

        He didn't 'choose' to study this... the data fell into his hands, and he offered analysis.

        This is a great little 'news for nerds' thing. The author says he has this data, he's smart enough not to publish it (just the analysis), he gives some interesting results from raw analysis of the 'data'. Take the story for what it is: Sunday morning on Slashdot.

        • Re: (Score:3, Insightful)

          by tomhudson (43916)

          My point was (if you had read the article) that his claim that he was able to measure the strength of the passwords was flawed. There were passwords that myspace couldn't have accepted as valid passwords because they require at least one digit (so "fuckyou" couldn't have been a password).

          The "known bad" data should have been dropped immediately.

    • Agreed. One would have to assume that there would be a high likelyhood that people who would fall for a phishing attack would be the same kinds of people who are uneducated about internet security, hence, strong password usage.

      Not only that, but in selecting Myspace to study strength of passwords, you're going to come to the conclusion that everyone on the planet is a moron. It would be like judging the intelligence of the average person by giving IQ tests during American Idol.

  • Email Passwrod (Score:5, Interesting)

    by lobsterGun (415085) on Sunday September 17 2006, @08:34AM (#16124420)
    It would be interesting to see how many of the names in that list use the same password for MySpace account as they do in their email account.
  • I have a few "sets" of passwords that I use. Basically it goes like this:

    1) Online banking - Very complex ( as complex as my banking site will allow that is ) / Important work related passwords
    2) Unimportant work related passwords (Such as the log in to view the cacti graphs for example) / Public websites that require a password and I care a little bit about
    3) Public websites I could give a rats ass about having broken into. Myspace would be listed here. So would my slashdot account.

    So my point is just because people use crappy passwords for myspace doesn't nesasarily mean they don't have a clue......but being caught by phishers does. ;)

      • Look! I stole your identity (Score:3, Funny)

        by Anonymous Coward
        best change your policy on your slashdot account now, or expect to see bogus postings in your name!! ;-)


        I think you should take the same advise. I just stole your account and now I'm posting as you Mr. Coward.....HAHAHAHA!

  • strong passwords? (Score:5, Informative)

    by nephridium (928664) on Sunday September 17 2006, @09:19AM (#16124564)
    Most common passwords used:

    13 - cookie123
    12 - iloveyou
    12 - password
    11 - abc123
    11 - fuckyou
    11 - miss4you
    9 - password19
    9 - clumsy
    8 - sassy
    8 - summer06
    8 - pablobob
    8 - boobie
    8 - fuckyou1
    8 - iloveyou1
    8 - tink69
    8 - password1
    7 - gospel
    7 - terrete
    7 - monster7
    7 - marlboro1
    7 - bitch1
    7 - flower
    7 - space

    Summary:

    While the passwords weren't the best, they weren't exactly terrible. [...]
    According to TFA it seems most passwords used on myspace are made up of dictionary words (mostly lower case) and a numeric suffix (usually <4 digits). Imho such a password does look horrible, especially after seeing how important some of the myspace pages seem to be for certain people.
  • I almost sense a disappointment that MySpace users didn't come out looking stupider. Give the MySpace users a break! Their computer illiteracy is made painfully clear, but imagine if Slashdot had a comparable way to highlight its posters social illiteracy. Perhaps there would be MySpacers writing on message boards about how stupid all Slashdot users were for their poor fashion sense. Yes, that would be stupid, but comparably as stupid as the blind, generalizing hate for MySpace users that is prevalent here.

  • strong passwords (Score:4, Interesting)

    by DigitalLifeForm (952353) on Sunday September 17 2006, @10:40AM (#16124823)
    There was an MIT study claiming that the strength of passwords was affected by length alone. Because of brute force cracking, the longer the password, the longer it took to break. Consider the three character password where I allowed only numbers, and upper and lower case letters. Each position in the password would have 10 + 26 + 26 = 62 possibilities. A three letter password would have 62 * 62 * 62 combinations. Now, if I required "strength" by requiring the use of a letter, and both upper and lower case, I now have only 10 * 26 * 26 combinations. Requiring "strength" always reduces the set of possible combinations for the password.

    • Re:strong passwords (Score:4, Interesting)

      by nobodynoone (940116) on Sunday September 17 2006, @10:58AM (#16124891)
      Yes, but in the instance of bruteforce, it is all about PERCIEVED strength, in which case the bruteforce attack must include numbers as well as letters, increasing possible combinations from the attack side to 36*36*36. So while the ACTUAL combinations may drop, the POSSIBLE combinations increase.

    • Re: (Score:3, Insightful)

      by mrcaseyj (902945)
      The probability calculation is flawed. Although restricting the choices of passwords reduces the number of possibilities it doesn't reduce them all that much. A three character password with an upper, a lower, and a digit, isn't 10*26*26 possibilities. The first char can be any of 62. The next char can be any of at least 36 but could be any of 52 if the first char was a digit. The last char could be any of at least 10. Thus the correct calculation is at LEAST 62*36*10 but is actually more.

      More importantly,

  • Obvious password detector (Score:5, Interesting)

    by Animats (122034) on Sunday September 17 2006, @11:30AM (#16125007) Homepage

    Twenty-two years on, here's my obvous password detector [animats.com]. This is C source code I wrote in 1984. This simple piece of code will prevent the use of passwords that are English words, by requiring that the password have at least two sequences of three letters not found in the dictionary. The "dictionary" is compressed down to a big table of hex constants; it's a 27x27x27 array of bool, with a 1 for each triplet found in the UNIX dictionary. So the code is simple, self-contained, and does no I/O.

    Put this in your password-change program and dictionary attacks stop working.

    The code is a bit dated; this is original K&R C, not ANSI C.

    I should do a Javascript version and give that out. The code is so small that it could easily be executed on user-side password pages.

  • Password Strength (Score:3, Insightful)

    by localman (111171) on Sunday September 17 2006, @01:05PM (#16125360) Homepage
    Most interesting to me is that despite most of the passwords being decent it makes not a lick of difference in these people being phished. Once again, being sharp and understanding of the big picture is more important than following any isolated rule about security. Good luck getting that out to the masses, though :)

    Cheers.

  • My password.... (Score:3, Funny)

    by CrazyTalk (662055) on Sunday September 17 2006, @05:23PM (#16126470)
    Is *******. That way I can always see what I'm typing.

  • One point deserves emphasis... (Score:5, Interesting)

    by dghcasp (459766) on Sunday September 17 2006, @05:30PM (#16126512)

    He came up with a rating scheme from 1 to 4, where 4 is the "best" password. And he says "I consider strength two fine for a myspace account." Very good point: Not all websites need the same level of password strength.

    My personal pet peeve is websites that probably only require a 2 or 3 (on his scale) but demand strength 99. For example, forum sites that reject passwords that my bank would consider good enough.

    Your password was rejected because it was only seven characters long, does not contain enough characters that are neither letters or numbers, and contains a substring that was found in a dictionary of Croation words. Plus, you used that password three years ago when we forced you to change it with our 30-day password aging policy.

    My plea to anyone reading this who develops websites: The strength of the password only has to match the importance of the information that it's protecting.

    Thus endeth my rant.

      • Re: (Score:3, Insightful)

        by AriaStar (964558)
        I read both sites because I like the different articles on each. But lately many of the same articles are on both. I suspect people are seeing articles there and submitting them here. I'd like to see variety again.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.