On: Weak passwords brute forced

[arasmussen]

I'd love to know just how weak "weak" is. Something like [A-Za-z0-9]+ and <= 6 characters, or [a-z]+ and <= 8 characters?

[FiloSottile → arasmussen]

Here, it is weak as in "password", "qwerty" or "{your Lifehacker leaked password}"

[codygman → FiloSottile]

my password was \w{6}\d{2} and it was compromised.

[FiloSottile → codygman]

Did you reuse that password somewhere else?

[mh- → codygman]

was the \w{6} github?

[codygman → mh-]

LOL, luckily it was not. It wasn't a dictionary word.