Cracking passwords with more than 10 characters in a few hours?

They're describing how a team of "hackers" cracked passwords such as this "qeadzcwrsfxv1331" or this "Qbesancon321" in just a few hours. How is that even possible? I've seen before people describing passwords with 12 characters or more (16 in the above case) to take supposedly thousands of years to crack. What's going on in this case? Ok, so in this case the team had the hashed passwords available, but a 16 character password in a few hours?

• Well, the former at least could be from guessing keyboard patterns. ​ (I don't immediately see such a pattern for the latter.) ​ ​ ​ ​
– user991
Nov 9 '15 at 23:37

Like Ricky Demer suggested, qeadzcwrsfxv is a common finger pattern (similar to something like asdfghjk).
The second example falls in the pattern of: Take dictionary word (besancon is the name of a city), uppercase the first letter and add a couple of digits after it (usually 123, 321, 007 or a year like 1998). Then a couple of rule-based alterations are tried: add a random letter, change a letter to a symbol (e.g. s => $) and so on. A third way one of these passwords could have been cracked is by them being reused from another hack (e.g. the user used a variation of the password he used from linkedin). In short, humans are very predictable in how they generate passwords. A truly random password looks like this: T8vWdvLGhpRi9Gb. No discernable words or patterns. Numbers, lowercase and capital letters properly mixed together. A password like this could only be broken by being reused on multiple websites or by being intercepted somehow. • It would be interesting to know how the cracker(s) structured the generative algorithm so that it would try more likely and longer "human" patterns like those in the question before searching for harder passwords. Although this answer is IMO correct, I'm not sure how to begin to search against "decorated" patterns. Clearly there is less entropy, but every shortcut to take advantage of it is a gamble. Nov 10 '15 at 11:46 • @NeilSlater You can find an example of how different variations are tried on hashcat's rule-based attack page. Basically, a word (e.g. "besancon") and a rule (e.g. ^Q$1$2$3) are combined into a candidate password. It's also possible that a combinator attack was used and the dictionary happened to include "Q", "besancon" and "123". Nov 10 '15 at 17:08