Cracking passwords with more than 10 characters in a few hours?

Like Ricky Demer suggested, qeadzcwrsfxv is a common finger pattern (similar to something like asdfghjk).
The second example falls in the pattern of: Take dictionary word (besancon is the name of a city), uppercase the first letter and add a couple of digits after it (usually 123, 321, 007 or a year like 1998). Then a couple of rule-based alterations are tried: add a random letter, change a letter to a symbol (e.g. s => $) and so on. A third way one of these passwords could have been cracked is by them being reused from another hack (e.g. the user used a variation of the password he used from linkedin). In short, humans are very predictable in how they generate passwords. A truly random password looks like this: T8vWdvLGhpRi9Gb. No discernable words or patterns. Numbers, lowercase and capital letters properly mixed together. A password like this could only be broken by being reused on multiple websites or by being intercepted somehow. • It would be interesting to know how the cracker(s) structured the generative algorithm so that it would try more likely and longer "human" patterns like those in the question before searching for harder passwords. Although this answer is IMO correct, I'm not sure how to begin to search against "decorated" patterns. Clearly there is less entropy, but every shortcut to take advantage of it is a gamble. – Neil Slater Nov 10 '15 at 11:46 • @NeilSlater You can find an example of how different variations are tried on hashcat's rule-based attack page. Basically, a word (e.g. "besancon") and a rule (e.g. ^Q$1$2$3) are combined into a candidate password. It's also possible that a combinator attack was used and the dictionary happened to include "Q", "besancon" and "123". – Daan Bakker Nov 10 '15 at 17:08