Where to find a list of bad passwords?

Posted by Steve Morgan on Server Fault See other posts from Server Fault or by Steve Morgan
Published on 2009-11-19T20:39:40Z Indexed on 2010/04/26 16:14 UTC
Read the original article Hit count: 302

Filed under:

passwords

|

bad-passwords

|

stop-list

I need to implement a 'stop list' to prevent users selecting common passwords in a new online service.

Can anyone point me to such a list online anywhere?

Edited: Note that I'm only trying to eliminate the most common passwords, not an exhaustive dictionary. And, of course, this complements a reasonably strong password policy (length, use of non-alpha characters, etc.)

Thanks.

© Server Fault or respective owner

Related posts about passwords

Fixing /etc/shadow with md5 passwords to sha512 passwords

as seen on Ask Ubuntu - Search for 'Ask Ubuntu'
I recently upgraded an ubuntu server with many users to a recent version from a version from 2008. The server used to use md5 password hashes (e.g., the shadow passwords began with $1$) and now is configured to use sha512. I'd prefer to keep using sha512, but would like the old users to be able… >>> More
How to securely generate memorable passwords?

as seen on Super User - Search for 'Super User'
Whenever I need new passwords I use some tools to generate those, preferable memorable passwords, but I've been wondering how secure this might actually be. Using The xkcd random number generator is probably pretty bad, cat /dev/random is probably pretty good, but generating memorable passwords seems… >>> More
Gawker Passwords

as seen on Geeks with Blogs - Search for 'Geeks with Blogs'
There has been much news about the hack of the Gawker web sites. There has even been an analysis of the common passwords found. This list is embarrassing in many ways. The most common password was "123456". The second most common password was "password". Much has also been written providing… >>> More
Phishing Ploy Forces Twitter to Reset Passwords

as seen on Internet.com - Search for 'Internet.com'
The microblogging site has reset some Twitter users' passwords after a phishing attack attempted to steal their login information. >>> More
Phishing Ploy Forces Twitter to Reset Passwords

as seen on Internet.com - Search for 'Internet.com'
The microblogging site has reset some Twitter users' passwords after a phishing attack attempted to steal their login information. >>> More

Related posts about bad-passwords

Where to find a list of bad passwords?

as seen on Server Fault - Search for 'Server Fault'
I need to implement a 'stop list' to prevent users selecting common passwords in a new online service. Can anyone point me to such a list online anywhere? Edited: Note that I'm only trying to eliminate the most common passwords, not an exhaustive dictionary. And, of course, this complements a reasonably… >>> More
Medusa: Open Source Software 'Login Brute-Forcer' for Password Auditing

as seen on Internet.com - Search for 'Internet.com'
By now, it's practically canon that bad passwords can have catastrophic consequences. What can a security admin do to ensure users are doing their part for server security? Enter Medusa, an open source software password auditing tool for Linux that will put all of your organization's passwords to… >>> More
System lockout, SAM error 12294

as seen on Server Fault - Search for 'Server Fault'
We are facing a login issue due to a SAM error with the error code 12294. Event Type: Error Event Source: SAM Event Category: None Event ID: 12294 Date: Time: User: Computer: Description: The SAM database was unable to lockout the account of due to a resource error, such as a hard disk write failure… >>> More
OpenLDAP Password Expiration with pwdReset=TRUE?

as seen on Server Fault - Search for 'Server Fault'
I have configured the ppolicy overlay for OpenLDAP to enable password policies. These things work: Password lockouts on too many failed attempts Password Change required once pwdReset=TRUE added to user entry Password Expirations If the account is locked out due to intrusion attempts (too many… >>> More
OpenLDAP Password Expiration with pwdReset=TRUE?

as seen on Server Fault - Search for 'Server Fault'
I have configured the ppolicy overlay for OpenLDAP to enable password policies. These things work: Password lockouts on too many failed attempts Password Change required once pwdReset=TRUE added to user entry Password Expirations If the account is locked out due to intrusion attempts (too many… >>> More