Well, considering that 292 of the passwords contain mixed case, 79 of them are 12 characters or more (this one's nice: "qwe123QWE!@#"), 59 of them contain non-alphanumeric characters, and 6713 of the 8655 passwords posted are unique ... it's probably only a matter of time.
Nice. I think it's time to upgrade all my passwords.
For what it's worth, my password was 8 random alphanumerics, and it's not in the list, while /.,mnbvcxz (12 alphanumerics with symbols) is there. The cracker must have some sort of algorithm that looks for consecutive patterns on the keyboard.
It goes to show that the old rules - non-dictionary word, mixed case, etc - really don't cut it anymore. Psychologically, picking a password that has high entropy is quite difficult, and the crackers are only going to develop better algorithms in the future. I think using a good random generator is the only way to ensure you have a decent password these days.
I dunno, they managed to crack "G7io5639*%V64ioT5h9" -- 19 characters including lowercase, uppercase, numbers, and symbols. It doesn't seem to follow any pattern on a QWERTY layout -- maybe another layout?
I wasn't aware they could crack passwords that long though -- wasn't that supposed to take years, even with a GPU?
I was surprised at how few randomly generated passwords there were in that list, if any. Like you mention, there's a lot of variants on qwerty/12345/!@#$%: 1qaz2wsx, Zaq1Xsw2, 1qazxsw23e, 1q2w3e, !@#$1234, etc.
"ZXasqw12!@" was about as random as it got from a quick scroll-through, and even that is basically just keys directly next to each other.
I assume randomness doesn't mean as much as sheer password length does when it comes to crackability, but I wonder if there's anything to be learned from this. Maybe only that random password generators tend to default to a safer (longer) length? :)
Random passwords are probably not going to be cracked by a run-through of John with a ruleset, which is likely similar to -- or exactly -- what was used to create this list.
These are salted FreeBSD MD5s (iterated hash); even with a powerful GPU, you're probably only going to be able to check a few hundred thousand per second at best.
Nice. I think it's time to upgrade all my passwords.