The worst passwords from the Ashley Madison hack

When hackers gained access to 36 million accounts on Ashley Madison, a dating website for married people, many were concerned and wanted to know what had been stolen.

A month after the breach was first disclosed, the hackers released the first batch of stolen data. Email addresses, passwords, and credit card transactions were leaked starting on August 18. A few days later, more data emerged, including internal emails with the site's parent company, Avid Media Life.

The tens of millions of passwords leaked from the Ashley Madison website were encrypted with bcrypt. Robert Graham, a security researcher at Errata Security, wrote on their blog that the move was a “refreshing change.” This means that users with strong passwords are “safe.”

However, the same cannot be said for weak passwords.

Security expert Dean Pierce reported that he was able to break the encryption of weak passwords with a “cracking rig.”

The results shouldn't surprise us. The use of weak passwords on the website was terrible.

Pierce spent five days running an automated password-cracking process, and stopped at about 0.0006 percent of the total data leaked. But that means 4,000 decrypted passwords.

The most common password was the familiar “123456,” while the equally familiar “password” came in second. (You can download the full list from Pierce’s Google Drive .)

It's worth noting that in the case of Ashley Madison, it's unclear when the leaked password data was from. It's possible that the site allowed weak passwords in its early days, and later required stronger ones when registering on the site. .

“It may also be impossible to crack every password with bcrypt, but given that many users use weak passwords, it doesn't matter if the passwords are bcrypted and salted. Some will be cracked.”

See the worst passwords from the Ashley Madison hack