LeakedSource's blog analyzed data breaches, covering password statistics and hashing weaknesses for leaks like Last.fm, Myspace, and Twitter.
HN links it for breach details and password analysis, such as Myspace's duplicate passwords and Last.fm's unsalted MD5 hashes.
>Can someone change the op's link to: >https://www.leakedsource.com/blog/twitter
No, let's not. First of all, leakedsource has already been submitted separately, but has fewer upvotes. Presumably people prefer the techcrunch version.
It's not really surprising, as leakedsource's article is poorly laid out. It doesn't even have a title (they've put "Preface" as a title, but that's the heading of the first section). Then there's the banner adverts at the top.
>The real source, not this redundant media crap that buried the lede...
The techcrunch article has responses from twitter and others, along with some analysis, so it's not "redundant media crap".
Yes and no.
Pass phrases are good, since (if backed by the same amount of entropy) they're easier to remember than passwords.
But for $DEITY's sake, don't use sentences. Natural human language has very, very poor entropy – especially since people gravitate towards catch phrases, song lyrics and the like, which can be (and have been[1]) very easily guessed.
That's why I put in diceware as fallback recommendation – while dice aren't perfect, they're a very decent source of entropy.
[1] https://www.leakedsource.com/i/lastfmlong.txt
https://www.leakedsource.com/blog/myspace
> Due to some accounts having two passwords, there are 427,484,128 total passwords for only 360 million users. Additionally, the accounts with password "homelesspa" seem to be automatically generated as all the emails that use this password follow the same format. We also suspect given the number of passwords with a 1 at the end, MySpace required numbers and letters at some point.
> The number of passwords and the severity of the hack was not uncovered until today. The passwords were stored using unsalted MD5 hashing
Enough said.
> The most popular password pulled from the Last.fm database was 123456. Seriously, it’s 2016 people
Sure, but the breach was in 2012 TechCrunch. Better article: http://www.leakedsource.com/blog/lastfm
You can get even better idea of their site growth (or lack thereof) from the above link (scroll to the bottom of the page) http://www.leakedsource.com/blog/lastfm
Can someone change the op's link to: https://www.leakedsource.com/blog/twitter
The real source, not this redundant media crap that buried the lede...