Password Attacks

The chart counts passwords people chose, from a single leak. RockYou made games and apps that ran inside Facebook and MySpace, and it kept its users' passwords in its database as plain text. In December 2009 an intruder pulled the whole table out through a flaw in one of its web pages, and the passwords of about 32 million accounts were soon posted online for anyone to download.

What share of RockYou's accounts used 123456? Estimate it from the chart.

About 0.9 percent of the accounts used it: 290,731 out of 32 million, nearly one in a hundred. Together, the ten on the chart cover about 2 percent of all accounts, and Imperva, the security company that analyzed the list, found that the 5,000 most common passwords were enough to cover about a fifth of them. An adversary with a short list of guesses doesn't need any one person's password. Across enough accounts, some will be on the list.

The studio's 80,000 player accounts face password attacks of both kinds. In one, the guesses arrive through the game's own sign-in page. In the other, an adversary who has stolen a copy of the account table works on it at home.

Suppose an adversary sprays 123456 at the studio's sign-in page, one try per account, and the studio's players choose passwords the way RockYou's users did. About how many accounts open?

About 720 would open: 0.9 percent of 80,000. A lockout counts wrong guesses on each account, and one wrong guess apiece reaches no account's limit, so the spray has to be caught some other way: by noticing a burst of failures spread across many different accounts.

Cracking tools do this work on graphics cards, the parts of a computer that draw the frames of a game like the studio's. A graphics card is built to run thousands of small calculations at once, and each guess is a separate small calculation, so one card tries guesses far faster than the computer's main processor.

A table like that is built once and used against any stolen file. Salt spoils it: when every account's hash was made with its own salt, no table built in advance matches.

The RockYou file did more harm after the break-in than during it. Because it held real choices rather than random strings, it became one of the most widely used guessing lists in the world, shipped with security testing tools and loaded into cracking programs. Lists from later breaches joined it, and many of those carried email addresses beside the passwords. People reuse passwords, so a pair from one site's leak is often the pair for another site.

Kali Linux, a system built for security testing, still ships the RockYou list among its word lists, more than fifteen years after the break-in.

The break-in caught up with RockYou in 2012, when it settled charges from the Federal Trade Commission that it had promised reasonable security while storing passwords in plain text and leaving its site open to a well-known kind of attack. RockYou agreed to 20 years of outside security audits and paid a 250,000 dollar penalty under a children's privacy law, for collecting children's information without their parents' consent.