Probable-Wordlists
Security and privacy
password wordlists
SHOW HN2017
How HN took it
4 positive, 7 neutral or asking, 0 mixed, 5 critical, out of 16 comments about the project. Thread score -0.14.
Idea: 2 for, 1 againstPrivacy: 2 for, 1 againstExecution: 0 for, 2 againstDocs: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Useful for validating new passwords against common lists
From 1 comment
This list is immediately useful for validating user-created new passwords. Just stop with the bizarre rules about having uppercase, lowercase, symbols, numbers, length, etc.…
lucasgonze on HN
Publishing it provides net benefit to defenders
From 2 comments
Audits. Education. Change. It's not like bad guys don't already have wordlists, or that they are new in any way. Having good ones available, in the open, for everyone to use,…
mvdwoord on HNIt's already exposed. That's the point. The adversary has this intel. It would be irresponsible not to study and publish it, thereby reducing their informational edge.
qeternity on HN
Objections
Exposing these lists mainly helps hackers and crackers
From 1 comment
Not to sound negative, but is this something we should really be exposing? It feels like the only ones who gain from this are hackers and password crackers, no?
smaili on HN
Lists are English-centric and US-biased
From 2 comments
Note that this password list is valid rather for English speaking world.
expertentipp on HNSpeaking of rarely updated - version two will come out mid-July at the latest. I'm also going to attempt to attribute the sources to given countries or at least language…
berzerk0 on HN
Torrent distribution has seed and size problems
From 1 comment
Is there really any reason to multiply the downloads by 4 just to have different compression methods? It seems to me like that just needlessly dilutes the seed swarm and wastes…
kaslai on HN
Requests
Package as a library or bloom filter for developers
From 2 comments
you should package this up as a bloom filter and simple js routine web developers could use to do client-side checks to validate passwords. edit: on 2nd thought looks like a…
gfody on HNI wonder about how to package your data as developer tools. There should be libraries in any language used to develop systems which validate user-entered passwords.
lucasgonze on HN
Use IPFS for distribution
From 1 comment
Have you considered using IPFS for distribution?
infinisil on HN
Questions
Why not load lists into a database with an index
From 2 comments
I don't understand: Why do you assume that password checkers keep their lists in alphabetically sorted form rather than just to load the whole thing into a db table with an index…
jacquesm on HNYes, but it doesn't matter what order they are in if you put them in a DB. I don't know anybody that would do a sequential scan over a file in production. All you've done is…
jacquesm on HN
Alternatives named
zxcvbn by Dropbox includes a common password list
From 1 comment
Dropbox has their zxcvbn method which incorporates a list of 30k of the most common passwords https://github.com/dropbox/zxcvbn
berzerk0 on HN