One Breach to Crack 'Em All! Insights from Password Breaches

The talk asks what leaked password data can teach both attackers and defenders. The speaker gathered about two terabytes of breach dumps, filtered them down to Swedish and Finnish credentials tied to roughly 240,000 domains, and loaded the results into a database for analysis with Python scripts. The corpus covered around 4.8 million passwords in total.

The findings focused on how people build passwords. About a quarter of them are exactly eight characters long, and most fall between six and nine characters. Over 40 percent contain recognizable dictionary words, and many follow predictable habits such as a trailing digit, a keyboard walk or a year. Around 4 percent used their email address as the password, and roughly 3 percent were reused across services. The speaker showed that dictionary attacks with rules crack a large share quickly, mask attacks cover many of the remaining patterns, and brute force is a last resort. Hash-speed benchmarks on a single consumer GPU illustrated how the hash type changes how long cracking takes.

For defenders, the recommendations were to reject known-breached or weak passwords at registration and login, require longer passwords or passphrases, enforce multi-factor authentication, rate-limit logins, and detect credential stuffing across services. The speaker also recommended password managers and unique credentials for every service. The talk closed by noting that passwords often reveal personal details, emotions and occasionally internal company information.