# How did this extortionist get my (possibly) password? **URL:** \ **Category:** Factual Questions\ **Created:** [October 17, 2018, 6:16pm UTC](https://boards.straightdope.com/t/how-did-this-extortionist-get-my-possibly-password/823102 "2018-10-17T18:16:30Z")\ **Posts on this page:** 6\ **Page:** 3
**Author:** ![glowacks](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/glowacks/32/5548_2.png) [@glowacks](https://boards.straightdope.com/u/glowacks)\ **Post date:** [March 26, 2019, 1:30am UTC](https://boards.straightdope.com/t/how-did-this-extortionist-get-my-possibly-password/823102/41 "2019-03-26T01:30:02Z")
> [@CookingWithGas](#): > > I agree with your overall point, but I would not use the word “encryption” since passwords are generally stored using hashing and hashing is a one-way algorithm. Something encrypted can be decrypted. Well, it’s kinda encryption, basically the same thing that enables blockchain technology - many different inputs can lead to the same output, but figuring out an input that allows a certain output is impossible except by brute forcing. When you have a dictionary attack on a hash function, they’re trying to find the simple word or phrase that gives the right result when hashed. They might luckily come across something that has the same hash that isn’t your password. Of course, this requires knowing the hash function, so exactly what hash function is used is really the most important thing to keep secret for password systems. Hashes are useless without knowing how they were constructed. ---
**Author:** ![ticker](https://avatars.discourse-cdn.com/v4/letter/t/d07c76/32.png) [@ticker](https://boards.straightdope.com/u/ticker)\ **Post date:** [March 26, 2019, 4:28am UTC](https://boards.straightdope.com/t/how-did-this-extortionist-get-my-possibly-password/823102/42 "2019-03-26T04:28:57Z")
> [@glowacks](#): > > Of course, this requires knowing the hash function, so exactly what hash function is used is really the most important thing to keep secret for password systems. Hashes are useless without knowing how they were constructed. This is not correct. It is very ill advised to create a ‘custom’ cryptographic hash function as you will almost certainly do a poor job which is vulnerable to attack. The industry relies on a small number of well known algorithms, created by experts, which are **trusted for exactly the reason that they are not secret yet have not been cracked**. Also, it would be risky to assume that your ‘secret’ hash function would remain secret as it would necessarily be stored in the form of executable program code, which could be stolen and reverse engineered. Industry best practice with regards to storing passwords is to store ‘salted’ hashes. Here a random string is added to the password to ensure that multiple instances of “password123” get hashed to different values because they were combined with different random strings. The random string is then stored alongside the hash so it can be combined with the incoming password again when checking for a match. The defats the easy dictionary attack whereby a hacker would pre-hash a list of likely passwords, then later compare her list of hashes with those stolen from your system and thus revealing passwords of any user who used a password from her list. With salted hashes the hacker must recompute the hashing of their list of common passwords for every hash/random string pair stolen from your system as they will need to combine their list with the random string. This is a LOT more work. ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [August 27, 2019, 7:05pm UTC](https://boards.straightdope.com/t/how-did-this-extortionist-get-my-possibly-password/823102/43 "2019-08-27T19:05:31Z")
I just found one of these in my spam folder. It would be much more believable if (a) the password wasn’t so laughingly different from virtually everything I use and (b) I actually masturbate at my computer. Oh, and this one only wanted $1500. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [August 27, 2019, 8:51pm UTC](https://boards.straightdope.com/t/how-did-this-extortionist-get-my-possibly-password/823102/44 "2019-08-27T20:51:53Z")
Just a tiny poll. Is anyone else getting these recently where the alleged password is something like “jonathan1”? I’ve gotten several with that “password” (which is wrong, of course) lately. I’m wondering if they are just being sent out with the same password to a million people hoping to scare a few who actually use something like that. I.e., the raindrop effect. ---
**Author:** ![steatopygia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steatopygia/32/3132_2.png) [@steatopygia](https://boards.straightdope.com/u/steatopygia)\ **Post date:** [August 27, 2019, 11:17pm UTC](https://boards.straightdope.com/t/how-did-this-extortionist-get-my-possibly-password/823102/45 "2019-08-27T23:17:48Z")
> [@ftg](#): > > Just a tiny poll. > > Is anyone else getting these recently where the alleged password is something like “jonathan1”? > > I’ve gotten several with that “password” (which is wrong, of course) lately. I’m wondering if they are just being sent out with the same password to a million people hoping to scare a few who actually use something like that. I.e., the raindrop effect. No. I just checked my spam folder and all of the 38 messages are legit. Places I’ve interacted with before. Where is the fingers-crossed smilie? ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [August 28, 2019, 2:40am UTC](https://boards.straightdope.com/t/how-did-this-extortionist-get-my-possibly-password/823102/46 "2019-08-28T02:40:19Z")
> [@ftg](#): > > Just a tiny poll. > > Is anyone else getting these recently where the alleged password is something like “jonathan1”? > > I’ve gotten several with that “password” (which is wrong, of course) lately. I’m wondering if they are just being sent out with the same password to a million people hoping to scare a few who actually use something like that. I.e., the raindrop effect. The stated password in mine appeared to be a random character string. There’s only one site on which I was given a random character string for a password with no obvious way to change and it’s certainly not a porn site. [Previous page](https://boards.straightdope.com/t/how-did-this-extortionist-get-my-possibly-password/823102.md?page=2)