RockYou

» see rockyou.com as it lived, on the wayback machine

~ the goodbye ~

i know this company from a filename. RockYou is a name engineers say constantly without thinking about where it came from, because rockyou.txt sits in the wordlist directory of every machine with security tooling installed on it. For years i had no idea there had been a company attached, let alone that the company made glitter text for MySpace profiles.

Lance Tokuda and Jia Shen started it in San Francisco in late 2005. The first product was a slideshow widget, a piece of embeddable code that put a rotating set of photos on your MySpace page at a time when MySpace itself gave you almost nothing and would not stop you injecting whatever you liked. That was the entire business model. Find the gap in somebody else's product, fill it with a widget.

Facebook opened its platform at f8 in May 2007 and RockYou was there on day one. Super Wall, Likeness, Hug Me, Vampires. By December 2007 it was the most successful application developer on the platform, with Sequoia Capital and SoftBank behind it and a real claim to being the company that made Facebook worth opening in the morning.

~ the chronicle ~

~ the funny part ~

The widget era was loud in a way that is genuinely hard to reconstruct now. RockYou's apps mostly worked by asking you to invite your friends before they would show you the thing you had just made, so a Super Wall post landed on everybody you knew with a request stapled to it. Facebook's early platform rewarded exactly that behavior, and then spent the next several years undoing it.

None of it is what the name means today. In December 2009 an attacker walked in through a SQL injection flaw that was already about ten years old and pulled the entire user database. 32,603,388 accounts, and not one password hashed. Every single one sat in the table exactly as the user had typed it, next to the email address it belonged to.

~ the postmortem ~

The FTC came after them in March 2012 and RockYou settled. The charges were partly about the plaintext storage and partly about children, since the company had collected roughly 179,000 email addresses and passwords from users under thirteen without ever asking a parent. The order carried a $250,000 civil penalty and twenty years of third-party security audits.

The business had already moved on. Tokuda stepped down as chief executive in November 2010 and Lisa Marino replaced him in April 2011. RockYou bought a couple of studios, then switched to buying up other people's finished games rather than making its own, taking titles off Disney and Digital Chocolate and Kabam and GREE after 2014. That is a company harvesting a back catalog rather than building anything. Chapter 7 was filed in the Southern District of New York on 13 February 2019.

~ the inheritance ~

The password file is the legacy and nobody intended it. Once the 32 million plaintext passwords were public, somebody stripped the duplicates, and what came out was 14,341,564 unique strings that real people had actually chosen to protect real accounts with. That is not a generated list and it is not a dictionary. It is a census.

It shipped as a default in Kali Linux and became the first thing every cracking tool reaches for. Seventeen years on it is still the standard a password policy gets tested against. Every organization that has run a strength check against rockyou.txt is borrowing the only durable asset a failed widget company ever produced. RockYou died in 2019. The mistake it made in 2009 is load-bearing infrastructure.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »