The recent hack of fembot dating extramarital affairs website Ashley Madison, which resulted in data from millions of accounts being dumped online, has one more salutary yet familiar lesson to deliver: even very well encrypted stupid passwords are still stupid.

While plenty of aspects of Ashley Madison’s business and operations have raised eyebrows, the firm did apparently use robust and respected encryption for its user passwords. But even bcrypt-hashed passwords can be cracked if the user chooses a stupid password, like, er, password. Or 123456. Read more…