Password Habits

[TheRealNathanQuinn]

Over the last month or so I've been trying to make cracking as time efficient as possible.
I have been looking at how people choose passwords and what they use in them.

I started off by cracking 500 non-migrated, new accounts (never been cracked before).

• 398 of the 500 account's passwords do not contain any upper case letters. (79.6%)
• 337 of the 500 account's passwords contain a number. (67.4%)

Now password lengths:

• 41 were 6 characters (8.2%)
• 67 were 7 characters (13.4%)
• 92 were 8 characters (18.4%)
• 96 were 9 characters (19.2%)
• 70 were 10 characters (14%)
• 50 were 11 characters (10%)
• 31 were 12 characters (6.2%)
• 22 were 13 characters (4.4%)
• 20 were 14 characters (4%)
• 7 were 15 characters (1.4%)
• 4 were 16 characters (0.8%)

I then cracked 200 new migrated accounts.
The passwords difficulty and length were roughly the same as the non-migrated accounts so theres no reason to post it again.

People commonly use their username in their email address for their account
ex. username=ShadowSam and the email for the account is ShadowSam@gmail.com

I used 6 popular email sites for testing, @Gmail.com, @yahoo.com, @Hotmail.com, @live.com, @Outlook.com, and @aol.com

I found the following results:

• 112 of the accounts were gmail
• 55 were yahoo
• 18 were outlook
• 10 were live
• 5 were hotmail
• 0 were aol

If any other crackers have questions about the data or want to pitch in their own data, feel free to reply.

A little bonus thing I noticed was that after 3 weeks of cracking only 8 of the 700 total accounts cracked have gone dead, this leads me to believe that if a person is claiming that alts are dieing on them fairly quickly or often that it may be them changing the password.

[zSm0ke]

Nice thread dude!

[RabidRunner]

With a cracker.

[Jew]

interesting info indeed.

[TGxCHA0S]

How exactly do you know if an account has never before been cracked? I'm curious on that, I didn't know data like that could be obtained.
Also, your testing group is very small. 200 accounts? Considering that there are (according to the Minecraft website) 18,106,356 people have bought the game.
Now, that number definitely is not accurate seeing as I refreshed the website 4-5 times and the number went up and went down.
However, we will round that number to 18 million. Next, we will cut it in half, 9 million. The percentage of alts that you looked at is a very small percentage (not even 1%) of the accounts that have been sold.

Yes, this data is somewhat useful, but it is nowhere close to anything that can be extremely effective.

However, I do appreciate you taking the time to post this. Even though I doubt half the people reading this will ever take into consideration what you wrote, or even know what to do with the information posted.