Another Password Analysis
The striking different between the two incidents is that the phpbb passwords are simpler. MySpace requires that passwords "must be between 6 and 10 characters, and contain at least 1 number or punctuation character." Most people satisfied this requirement by simply appending "1" to the ends of their passwords. The phpbb site has no such restrictions—the passwords are shorter and rarely contain anything more than a dictionary word.
Seems like we still can't choose good passwords. Conficker.B exploits this, trying about 200 common passwords to help spread itself.
Posted on February 20, 2009 at 7:31 AM • 60 Comments