Really Bad Passwords (with Unsalted Hashes)

The June, 2012, LinkedIn password breach reminds us all the need to protect our user’s passwords.

The following table includes a series of really, really bad passwords. These are passwords that are trivially cracked using an automated tool, such as John the Ripper, or have been found through public password hacks as being in use by real people. This is a simple rainbow table because it lists the precomputed unsalted SHA1 and MD5 hashes.

Please note that some of the words in this list are profane. Some people really do use those in passwords that have been breached.

As a website or web application operator, one should never use unsalted password hashes. Both a site salt and an account-specific salt should be used. This prevents the hashes from being used to locate accounts on other breached sites and also prevents the attacker from knowing that two or more users on the system have the same password. Remember, passwords are legally Protected Personally Identifiable Information (PPII)

In closing

Password security is important. Please do it right. Both to protect your company, your users, and society as a whole.