Passwords That Should Never Be Used

The Original Yama writes "Strong passwords are your first step in securing your systems. If a password can be easily guessed or compromised using a simple dictionary attack, your systems will be vulnerable to hackers, worms, Trojans, and viruses. PCLinuxOnline provides an alphanumerical list of list of commonly used weak passwords that should never be used. If any of these passwords look hauntingly familiar and are being used, you should change the password immediately."

Comments

missed one...

[Anonymous Coward]

I worked ISP tech support and the one I remember showing up way too often was:

thx1138

Re:missed one...

[linzeal]

One that I have seen more than ofter, fuckyou. Heh, when you make registration too difficult they get pissed at you.

Re:missed one...

[Prior Restraint]

I'm sure a thousand people will reply, but here: THX 1138.

I've secured my Internet privacy

[prostoalex]

I've protected my privacy and use Gator for all my passwords.

I keep it simple

[Anonymous Coward]

I use PASSWORD for everything.

Re:I keep it simple

[ConceptJunkie]

Yeah, I could have guessed that. I think a lot of people are using your /. account to post. I see that username dozens of times in every story.

I'm surprised that the classic "xyzzy" isn't in the list. Other words I would have expected to see "fred", "bofh", "windows", and "billgatescanbitemyshinymetalass".

Re:I keep it simple

[Brandybuck]

"billgatescanbitemyshinymetalass"

It's eery how close that is to my own password!

Anonymous Coward NY Times passwd

[me98411]

I do not see "slashdotcoward" in the list. Looks like it is a strong passwd. Isn't that the login and passwd used by Anonymous Coward for NY times?

Top 10 Passwords Not to be Used

[AtariAmarok]

10. iluvalqueda

9. idareyoutoguessthis

8. oldfattylumpkinwhosewisenoseledushere

7. *******

6. (my actual password)

5. cowboyneal

4. pencil

3. neo

2. secret

1. password

Re:Top 10 Passwords Not to be Used

[Josh Booth]

I'm surprised "gandalf" is not there. Everyone knows that it's the password of every other root account in the world.

Re:Top 10 Passwords Not to be Used

[zerblat]

Don't you mean "friend" (or possibly "mellon")?

Re:Top 10 Passwords Not to be Used

[Anonymous Coward]

Posting anonymously to not get myself in trouble... hi mike!

I worked with this engineer, call him mike, who had an account on a customer's machine. He was on vacation when the customer wanted a little help with that machine. The other engineer and I call mike to get his login and password to do some remote maintenance. Mike is reluctant to tell us the password. We think he's just being secretive, until he asks to be taken off speaker phone so he can tell us. His password: bigblackdonkeydick.

Sometimes password isn't so bad...

strong passwords = broken by design

[eraserewind]

Your users shouldn't require anything more than a 4 digit pin & a magnetic card. If it's enough to protect their money, it's surely enough to protect some stupid data.

Any lame brained security system that depends on people choosing difficult to remember passwords and changing them every 3-6 months is broken by design.

Re:strong passwords = broken by design

[lambent]

A mag-strip card IS a type of password. Depending on the institution that issued it, it's a rediculously long propietary password. It's a string of encoded bits. Nothing magical about it.

Furthermore, most people (and by most, i mean just about everyone), NEVER change either their PIN or their card, unless it's stolen. Is that type of system any more secure?

Re:strong passwords = broken by design

[babbage]

A mag-strip card IS a type of password

Kinda... not really.

The important thing to keep in mind for any authentication system -- not just computers, but any system that requires people to identify themselves -- is that there are basically three ways to go about it:

1. Something you know. (A password or passphrase; your mother's maiden name; your favorite song.)
2. Something you have. (Some kind of physical token like an ATM card, the key for your car or house, the hardware decorder in a DVD player, or one of the hardware dongles that was briefly popular for enforcing software licenses a few years ago.)
3. Something you are. (Biometrics: your thumbprint or retina scan; your photo & physical description on a license or passport [which itself is something you have -- see above]; DNA samples; voice or handwriting recognition; etc.)

Good security systems use at least two of these authentication classes: the ATM doesn't work unless you insert your card (something you have) and enter your PIN (something you know); when travelling abroad, customs agents will examine your passport (something you have), will cross-check your appearance against the passport's photo & description (something you are), and may ask probing questions about your travel plans (something you know).

Bad security systems rely exclusively on one of these elements. Basically all Internet security comes down to things you know, a/k/a passwords. From your point of view, an online purchase may seem to involve something you know (a password) and something you have (the numbers on your credit cards), but from the merchant's point of view they're just taking your word for it because they have no way to validate that the security token you're using is actually in your possession -- hence, credit card fraud. Likewise, I've voted in every election since I turned 18, and not once has an election worker asked for anything more than my name & address (something I claim I know) -- they never ask for an ID (something I have) or a fingerprint (something I am) etc. With this kind of scrutiny, it wouldn't be very hard for someone to spend all day voting in every precinct around. (I'm hopeful that electronic voting may actually fix this problem, but if as seems likely it introduces even more avenues for fraud then forget it.)

So, a password is essentially something you know, while an access card is something you have. There's a subtle but essential difference. If it was a string of numbers stamped on the card in an easily human readable way, then it could be considered as a form of password, but the fact that you need a machine to read it really enforces the point that it's something different. And that's why it's a good thing! A computer security system that relied on both traditional passwords as well as this kind of physical token would stand a much better chance of being robust than any system that used only passwords or tokens.

The problem is, almost nobody has a computer capable of reading such tokens. Aside from point of sale systems, almost no one has any use for card reading wedges, so building an authentication system around a requirement for card readers would be difficult to deploy broadly. Setting it as a general company policy might not be hard to do for most companies, if only because there you have a hope of installing the reader hardware for all users. Requiring a dual "know/have" or "know/are" system only for certain systems (access to sensitive areas, etc) would be prudent for any business to implement, but going from there to building a business of providing such systems to the general public would be much harder as long as the infrastructure doesn't exist -- that is, as long as Dell isn't shipping access card readers with every machine they sell.

So: something you know, something you have, something you area. Keep these in mind and the analysis of secure authentication mechanisms gets much clearer.

Re:strong passwords = broken by design

[hyc]

Well, that's all great, but the "something you have" is turned into "something you know" by the computer itself. And if all you're doing is logging into a local box so that you can use it to access a remote server or application, then once again you're only dealing in terms of "something you know" (or perhaps, something your computer knows and asserts on your behalf).

It's OK when the electronic security system is just an interface to a physical lock, like an electronic gate control. You seldom/never have interactive command access to the actual computer that operates the lock, so it's relatively safe from hacking. But if you're just logging into a computer for the sake of using that computer, then you can easily extract the transform of "what you have" into "what the computer knows" and propagate it further from there.

Re:strong passwords = broken by design

[John Hasler]

> Your users shouldn't require anything more than a
> 4 digit pin & a magnetic card. If it's enough to
> protect their money...

But it isn't.

This one real cool password I had...

[Kevin Stevens]

It used to be so great...

There was this obscure OS that no one had ever heard of... man it was cool... it was like unix on the pc... and this guy that developed it... this guy from scandanavia. You see it was really clever because it was a play on his actual name, and easy to remember.

Then... 1998 came. Its been downhill from there. I wouldnt even trust it to a hotmail account now.

huh?

[Hythlodaeus]

Q54arwms is a commonly used password? Is this some part of the collective unconscious I'm unaware of? Half the things in the list seem like they came out of a random generator, yet they are common?

Re:huh?

[Josh Booth]

I'm assuming that most of the passwords are defaults that some guy in a computer lab decided looked strong. However, when every system you ever produced uses the same password, even if it is completely random, you'll have a security problem.

Re:huh?

[jfdawes]

Google is your friend

Explained

Re:huh?

[m.koch]

Q54arwms is a commonly used password? Is this some part of the collective unconscious I'm unaware of? Half the things in the list seem like they came out of a random generator, yet they are common?

As google told me, these are default passwords from this list which is in fact much more useful.

Re:huh?

[jrumney]

SAP R/3 was released. They use those as default passwords for their software.

Hmm, not really trolling...

[smoondog]

OK, every once in a while we get an article similar to this. The links change but the article is the same. Passwords are inherently insecure to some sort of guessing attack, is the statement.

I'm going to suggest something here that is perhaps a little controversial. Perhaps, if password zealots spent less time complaining about passwords and spent more time protecting machines from this sort of attack (w/o making an easy path to a DOS attack) this wouldn't be an issue. Imagine this: Passwords are never transfered as plain text. Any systematic attempt at guessing a password is prevented before the attacker gains access. Users make mistakes a few times, even for the most simple passwords, one must sample tens of passwords to break in. Systematic attempts are predictable, just like trolls on slashdot are (generally) identifiable (remember those page lengthening posts?) and spam is filterable.

In my not so humble opinion, password guessing attacks are an administrator problem, not a user problem. And the administrators seem more interested in pestering users than actually developing systems to prevent this type of attack.

-Sean

You forgot...

[omarius]

0. idkfa -1. spispopd

Universal Passwords

[Schezar]

The uni I work for (RIT) is working to migrate their entire campus to a Microsoft Active Directory environment. Part of the reason for this is to give users a universal username/password for any and all university services.

Now, they enforce basic password etiquette (minimum length, non-alpha character requirement, etc...), which helps the situation somewhat (aside from the office biddies who write them on post-it notes on their CRTs), but the situation is far from secure.

Students use their webmail (Exchange... I won't even get into that one...) and register for classes (telnet), and generally aren't careful with their passwords. I couldn't tell you how many times I've sat down at a public terminal to find someone else's account all set up for me to exploit. And since the password is universal, I can do anything I want.

Myself, I use a different password for everything I connect to, and thus don't have to worry about being wholly compromised in an instant. Then again, I'm a geek, so I'm not exactly the norm.

Does anyone else see this push toward universal logins/passwords as a problem?

Re:Universal Passwords

[jfdawes]

Now, they enforce basic password etiquette (minimum length, non-alpha character requirement, etc...), which helps the situation somewhat

Er, no? Most "password etiquette" schemes are a complete crock. Generally all they do is reduce the key space and therefore make the passwords easier to brute force attack.

You must have a password of at least 6 characters? Well, there goes everything 5 characters and less - don't have to check those.

Hmm, and while we're at it, most people are going to have a password between 6 and 9 characters, don't bother trying anything else until the second pass.

You have to have at least one non-alpha, well - I can reduce my attack to constrain my guesses around that requirement - just reduced the number of attempts necessary by 24%.

Any other rules you want to add to make attacking the password easier?

Re:Universal Passwords

[CanSpice]

Limiting passwords to 6 characters or longer doesn't significantly reduce your keyspace. If you only allow lowercase letters, there are 12356630 possible combinations that are 5 characters and shorter, and there are 321272406 that are 6 characters and shorter. Thus if you don't allow anything shorter than 6 characters you've reduced your keyspace by roughly 3 percent.

If you allow upper and lowercase characters, there are 387659012 combinations that are 5 characters and shorter, and 20158268676 that are 6 characters and shorter. If you limit your passwords to being exactly 6 characters long then you've reduced your keyspace by 1.9 percent.

Those percentages only go up if you allow passwords that are longer than 6 characters, and if you allow characters other than letters in your passwords.

Sure, you're reducing your keyspace but it's not nearly as catastrophic as you make it sound.

Re:Universal Passwords

[jfdawes]

Yup. The length being constrained to greater than some number (typically 6 or 8) characters is about the only password constraint that makes sense some kind of sense, but still - any reduction in keyspace means less work.

Assuming we take the example of the guy who had the 5 byte password that takes 18 days to crack, 1.9% still saves you 8 hours. Not an unuseful amount of time.

It's the daft "must include an non-alpha" and "must start with an alpha (or worse, a capital)" and other brain dead, crack smoking, glue sniffing password "rules" that are the real killers

Re:Universal Passwords

[Frnknstn]

Forgive me, but I have no idea what you are talking about. Nowhere do I claim any such thing. I do claim that 98814936052800 is greater than 321272406 (98814936052800 > 321272406).

98814936052800 is the number of all passwords with lengths from six to nine with at least one number.

321272406 is the number of all passwords with lengths from one to six, as would be picked by unregulated users.

Re:Universal Passwords

[Prior Restraint]

One of my credit cards (which I have since cancelled) demanded that the 4-digit PIN not start with zero or one.

Re:Universal Passwords

[james b]

Thinking out loud: the thing about 'must include non-alpha' is that it essentially forces the users to pick non-dictionary words. That's good all by itself. Sure, some of them will just use 'password1' or whatever, which is still dictionary-able (but not much *more* so, since they're probably going to pick the word they always choose anyway and just add a number). And with many users, you'll get stuff that's somewhat hard to do a dictionary attack on, like 'jack4betty' or 'y311ow'.
Does this make any sense? I mean, I can see how suboptimal use provides no further protection, but is it likely to reduce the keyspace much in a real world scenario?

Re:Universal Passwords

[Eivind]

You're rigth, in principle, practically however, you are wrong.

It is true, for example that excluding 5-and-under passwords reduces the keyspace. But that is still a win if that part of the keyspace was overpopulated.

Put differently, if everyone has passwords 8 characters or less, choosen from a set of 64 characters (I realise there's more, but some are much more used than others, so the effective strength of a password choosen by a user is seldom more than 6bit/char)

• There's 2^(5*6) = 2^30 passwords that are exactly 5 characters long.
• There's 1.015 * 2^30 passwords that are 5 or less characters wrong.
• There are about 2**(8*6) = 2**48 passwords in total.
• So, by excluding the shorter ones, you've excluded 0.00038% of your keyspace.

If users choose passwords randomly, then one in 262000 users would choose a password with 5 or less characters, and for an attacker, searching this keyspace would be no more fruitful than searching any other random part of the keyspace.

Problem is, users do NOT typically choose passwords anywhere close to randomly. A more typical scenario is that 10% of all the users choose passwords 5 characters or less.

In that case, searching the 5-or-less part of the keyspace is 26000 times more likely to net you a working password than choosing a random part of the keyspace to search.

In practice, you can brute-force the 30-bit 5-and-under keyspace in minutes, and you'll have passwords for 10% of the user-accounts, allthough you only searched less than one thousandth of one percent of the keyspace.

THAT is why requiring users to have passwords over a minimum length does not, as you claim, harm security. (instead it helps quite a bit)

Re:Universal Passwords

[Eivind]

But 5 byte-and-under passwords aren't 1.9% of (say) a 8-byte password keyspace. If users use a small set of characters (64) then it's 0.00038 % of the keyspace. If they use a better (i.e. larger) set of characters, then it's even less.

I agree that rules that restrict the keyspace *more* than they force users to increase entropy are pointless or even harmful. "Must start with a capital" is obviously in this category. "Must include some sign that is not a letter" is probably not, because, again, the rule excludes maybe 0.0005% of all passwords, but forces 10-30% of users, the ones which otherwise would choose "all alphas" to select a better password.

Guess I should change my password

[lightspawn]

I've been using that same old password from one of my favorite movies.

Of course, I use the variant spelling.

Some pretty complex ones are there too...

[Artega VH]

As a comment at the bottom says:
A52896nG93096a

but also:
dn_04rjc
ksdjfg934t
sldkj754

----
I was going to ask why how this list was compiled,
but since I got really interested I happened to
google these and found the following:
This seems to indicate that ksdjfg934t is a default
password for a SuperMicro PC BIOS Console.

And from the same site: Micronics has a PC-BIOS
which uses dn_04rjc as the default password as
does Micron for the password sldkj754.

I want to know how often these passwords are used
for services that a open to the internet, or even
to the local network. I would imagine that these
bios passwords are only able to be entered
locally? If so why does that merit a place on this
"Passwords that should NEVER be used!" list...
apart from the fact that now this list will be
used in lame dictionary attacks....

Re:Some pretty complex ones are there too...

[gl4ss]

it's just a stupid list to made up to get some 'content' into a contentless article, f'kin waste of time really(the whole article). they could have just linked to some dictionary file used in these attacks and saved the hassle since they can't possible cover the passwords one shouldn't use and since they decided to go for the default/master bios passwords and shit like that the whole point is lost.

Favorites from the Real World

[angst_ridden_hipster]

Of course, none of these are very good as passwords (mostly vulnerable to dictionary attacks), but amusing nonetheless:

Mr.Root

logout

friend
friend and enter

open sesame
open tahini

open the door HAL

admit1

lemmeIN

hey,babe
what'syoursign?

Since I'm a little slow, the last two had me puzzled. It was explained to me that they were "pass words," i.e., words used in making passes.

John the Ripper

[Dammital]

Last July I installed John the Ripper on my home firewall. John is a password cracker, something like crack and l0phtcrack. I wanted to see how vulnerable my own passwords were.

From what I can tell, John runs a dictionary-based attack against your master.passwd file, then runs the dictionary with various shifts in capitalization, then runs the dictionary again with an assortment of numeric digits inserted into its guesses.

Finally John just runs a brute-force attack, generating passwords with successively longer and longer lengths until it lucks out.

In my case John finally did luck out, finding one of my passwords after 18 days of crunching numbers. This particular account had a relatively weak password -- though no dictionary attack would have found it, it was still only five bytes long. That's a wakeup call for me. I've been using shorter passwords for years, thinking that by avoiding common words I was safe. But I can see that they're breakable now.

It's one thing for someone to preach that you should really have longer passwords; it's quite another to see it for yourself. If your passwords are easy to guess, or are variants of dictionary words, or can be generated easily by brute force -- there are widely available tools that can give the keys to the city to any lowlife that wants into your machine.

Run one of the password crackers on your own system today, and become enlightened! And don't be comforted by the 18 days it took to crack my easy five-character password on a 300MHz Celeron notebook: there's also a distributed version of John the Ripper that divides up the work of cracking your password file among many computers.

The more I learn about security, and the tighter I make my systems, the more afraid I am. If you aren't afraid, you are either very very good at what you do -- and I humbly bow before you -- or you haven't much of a clue.

I'm safe!

[babbage]

Woohoo! My trusty old 1234567890 didn't make the list!

/me wipes brow at his well-chosen password

An honest look at password creation

[WarPresident]

(January)
User: Tim
Password: NEWUSER

YOU MUST CHANGE YOUR PASSWORD EVERY 30 DAYS
PASSWORD MUST HAVE AT LEAST 6 ALPHA AND 2 NUMERIC/OTHER CHARACTERS
New Password: password

PASSWORD MUST HAVE AT LEAST 6 ALPHA AND 2 NUMERIC/OTHER CHARACTERS
New Password: password01

OK ...
(February)
User: Tim
Password: password01

YOU MUST CHANGE YOUR PASSWORD EVERY 30 DAYS
PASSWORD MUST HAVE AT LEAST 6 ALPHA AND 2 NUMERIC/OTHER CHARACTERS
New Password: password01

THIS PASSWORD HAS BEEN USED RECENTLY
YOU MUST CHANGE YOUR PASSWORD EVERY 30 DAYS
PASSWORD MUST HAVE AT LEAST 6 ALPHA AND 2 NUMERIC/OTHER CHARACTERS
New Password: password02

OK ...
(March)
User: Tim
Password: password02

YOU MUST CHANGE YOUR PASSWORD EVERY 30 DAYS
PASSWORD MUST HAVE AT LEAST 6 ALPHA AND 2 NUMERIC/OTHER CHARACTERS
New Password: password03

OK ...

repeat ad nauseum

Re:An honest look at password creation

[BRSloth]

Login: yes
Password: i dont have one
password is incorrect

Login: yes
Password: incorrect

Re:An honest look at password creation

[squiggleslash]

Interestingly "NEWUSER" isn't on the list, and most organizations I've worked with use that as the initial password for new accounts...

Ok, now the mind boggles. The other password I see all the time as a "default" is "welcome". That's not on the list either. How does 240653C9467E45 make the list, but not WELCOME or NEWUSER?

Only an idiot

[chaotica1974]

Would have the password 12345 on his luggage!

How are my passwords?

[MBCook]

Lets see...

fizzlebop... OK
coodleschmidt... OK
sneedalbiz... OK
testripithia... OK
crumblehip... OK
skazeltank... OK

OK, all my passwords are safe. No one will ever guess 'em.

.

.

Crud!

Use and algorithm to generate your password

[Zugok]

Given the case a password has to be changed every month

pick as day from every month of the year which has some significance and is easy to remember. This date remains the same year after year, which I think is sufficient variability because you are going to do more with the date.

arrange the date and the current year in numerical format such as MMDDYYYY or YYYY-MM-DD

use date seperator . / or - as their mathematical operators, combine different operators be creative e.g. YYYY.MM-DD or DD/MM-YYYY or simply YYYY-MM-DD.

take the result and convert it into hex (because hex can also contain letters A-F)

if the hex result is does not meet password etiquette (unlikely), attach a description of the signifcance to the date chosen, if the date is a birthday, choose that person's name for exapm. Say the hex result is 1FF0, and the name is Stacey, generate a password like Stacey1FF0 or S1tFaFcoey or Sta1FF0cey. Again, be creative.

Dates are easy to remember, not a lot of effort is required. In this method, all that needs to be remembered is an algorithm.

Granted with each passing year, the variation in the password is not going to change a lot to the password that month a year ago, so it is still important to change how the the mathematical operators are used, how the YYYY MM DD are aranged. To add more variability, perhaps throw in the day into the mix like 1 for Monday, 2 for Tuesday. That's rather simplistic, but there is a lot more that can be done be creative. It's not hard.

Password rules at IBM Watson Research

[Latent Heat]

There is this story I heard attributed to IBM Watson that some wag has concocted a detailed list of password restrictions (no all numbers, no all characters, and so on) where the joke was that if you rigorously applied all of the rules, there was only one legal password.

Re:Password rules at IBM Watson Research

[SpaceLifeForm]

'Sc0su><s'

REALLY bad password

[utahjazz]

Given that most web developers write code like this:

sqlexec("SELECT * FROM users where pwd = '" + pwd + "'")

I find a good password to be:

'; DELETE FROM USERS; SELECT '

PHBs seriously love "password"

[Wylfing]

I can't count how many technologically ignorant managers I've met who, giggling and leaning in close, explain that they've thought up the cleverest password ever. It's "password"! It's so obvious no one will think of it!

Short passwords??

[Anonymous Coward]

The only SAFE password is a long one: http://support.microsoft.com/default.aspx?scid=kb; en-us;276304!

Honey Pot Passwords?

[LoveMe2Times]

Does anybody out there use honeypot passwords? It seems like such an obvious idea, but it doesn't seem to be generally implemented -- at least no system that's ever given me a password has let me configure honeypot passwords. Personally, I'd really like to have a honeypot PIN for my bankcard and honeypot passwords for all of the online shopping/bills/finance stuff--ie, the stuff where it's important.

For those unfamiliar, the idea behind a honeypot password is either

1. to pick one or many "guessable" passwords like those in the article and use them as honeypot passwords. Allow somebody to log into the system using them but set off a silent alarm. Presumably, any would-be hacker will "crack" the honeypot password before the "real" password and will quit trying to get the real one.
2. Have one "real looking" password (especially PIN) that you can give out if somebody demands it at gun or knife point (you get the idea). If used, it immediately notifies the authorities (silently) and shuts down the account/card in say 1/2 hour (presumably enough time for you to get away). For the would-be mugger etc there's no way to tell if they got the "real" or the honeypot password.

Re:Honey Pot Passwords?

[stevey]

Because it's a simple way of locking out other people of their accounts.

I could go over to a colleagues PC and deliberately enter the wrong password five times when she's away to lunch.

When she comes back she finds her account has been disabled, and she's locked out until the sysadmin resets it.

At home this might not be a problem, but allowing people to lockout a remote worker from their VPN connection when they're working on something important isn't a good idea.

I log failed passwords on our machines sure, but disabling them automatically is too much for me.

When I was working in IT

[einTier]

When I was working in IT, I often said, "give me the names of a given person's children, their pets, their significant others, the kind of car they drive, their job title, and any hobbies, and I'll guess 95% of all passwords."

It's scary how many people think the name of their child makes a great password.

Uncanny!

[crawdaddy]

Numeric insecure password list: 0, 1, 1.1, 2, 5, 7, 12, 30, 110, 111, 123, 1111, 1234, 2002, 2003, 2222, 2600, 8429, 12345, 54321, 111111, 121212, 123123, 123456, 166816, 256256, 654321, 1234567, 1322222, 7061992, 11111111, 12345678, 19920706, 22222222, 88888888, 123456789, 1. 1, 1234qwer, 123abc, 123asd, 123qwe, 1RRWTTOOI, 240653C9467E45, 24Banc81, 3098z, 3ep5w2u, 4Dgifts, 4getme2, 4tas, 57gbzb

12345?! That's incredible! That's the same combination I use on my luggage!

Things To Never Use

[Piquan]

MEMORANDUM

From: Information Services

To: All personell

Re: Secure computing practices

The following, found during a routine review of our authentication system, are insecure and should never be used:

• accounting
• admin
• backup
• boss
• cisco
• congress
• death
• engineer
• ibm
• internet
• kiddie
• love
• manager
• sex
• snake
• user
• windows
• www

Avoid anything on this list. Any personell using anything on this list will be required to attend a mandatory fnord security training class, and may possibly face reprimands for repeat offenses.

no qwerty?

[Arngautr]

Yes!! qwerty wasn't one of 'em that means I'm safe, er... um, yeah....

notobvious

[richie2000]

The UUCP password for all customers on a certain large american ISP was for a very long time 'notobvious'. I still get a chuckle out of imagining how it came to be:

Technician: What should we set the password to, boss?
Boss: I don't care, just pick one that's not obvious.
Technician: Right, boss.

To be fair, it was just the password to login to the modem server, every customer had an additional real password to actually access the UUCP box behind it.

US Army does this

[Amata]

The US Army (and the rest of the military) is in fact going to this type of approach. Every soldier, for an ID card, is issued a card with a smart chip. This card, among other uses, is inserted into a smart card reader that is hooked up to every Army AIS (around here at least) to log on. The old user/pass method may also be used to log on, but I'm not sure how long that will last.

Brief overview may be found here: army.carlisle.mil

It's useless

[toshka]

If you see some guy/gal trying to guess a password you're watching a movie. If someone has your passwd file you've already screwed up. At least that's what my experience as an ISP tech support, a network admin and a web programmer has taught me... In the real world we have security holes and yellow stickers with passwords on the monitors(no, I'm not talking about my workplace:)...

Spaceballs

[jubitzu]

Dark Helmet: 1-2-3-4-5? That's the stupidest combination I ever heard in my life. That's the kind of thing an idiot would have on his luggage. President Skroob: 1-2-3-4-5? That's amazing! I've got the same combination on my luggage.

Outdated list

[MasterMnd]

I'm thinking that pdp8 and pdp11 are not likely to be that common anymore. Perhaps this list was a bit more accurate 20 years ago.

Ah, well, now I've got to change all of my root passwords from youwontguessme to p^$$w0rd. Hey, at least it's not on the list.

Re:Yeouch... [ot]

[JediTrainer]

Well, if you're using Java, you'd use a PreparedStatement.

But if you're smart, you'd know that storing a password in plaintext is insecure (in case your database is compromised). You should be using encryption. Something like MD5 or SHA would do the trick.

If you take the input string, then MD5sum it and store/compare THAT in the database, you should be fine.

Of course, you should still check all of your other input for any other queries you do, but I'll save that as an exercise for the reader.

/me is wondering how many people read the parent and instantly went into a panic :)

'Leet speak and letter/number substitution

[dspyder]

I had always recommended and sometimes used passwords written 'leet speak style, with numbers instead of letters.

I then found out somebody wrote a password cracker that uses those rules... out went that idea!

I have always suggested the following:

• non-dictionary words
• non-related to you words (kids, pets, town, etc.)
• Combination of numbers, in the middle of a word or 2

I once worked with a sysadmin who used song titles... I thought he was really clever until I learnt 2atgilb4 was "To All the Girls I Loved Before"... kinda clever... a bitch to type.

Our current sa password to most of our databases is !myday (not my day).

--D

Re:Remember Demolition Man

[plover]

There are several important distinctions to be made between something you "have" vs something you "are".

Here are some points to ponder regarding something you "are":

• Your biometric data must be digitized before a computer system can make use of it.
• Your biometric data is not secret.
• Your biometric data is unchangeable.
• Your biometric data cannot respond uniquely to every request made of it.
• It may be difficult or impossible for the user to validate that they are being "read" by a legitimate scanner.

And here are some points regarding something you can have - a smart card:

• A smart card has an internal digital processor plus some data.
• A smart card responds uniquely to every challenge made.
• A smart card's contents cannot be casually read without sophisticated equipment.
• A smart card can be deactivated or disposed of and replaced in the event of compromise.

What do these points mean? Biometric information can be copied at many levels, and presented as "real" data at many points in the security perimeter. A fake fingerprint can be made for under $20 and almost no skill is required. Mallory can hold up a photo in front of an unattended camera to convince a system that Alice is at the reader. A "fake" retinal scanner could be placed in front of a "real" retinal scanner at the bank's Eye-ATM machine ('retinal skimming' just sounds evil.) Or, the thumbprint reader at the Bada Bing's cash register might actually be a thumbprint/DNA recorder manned by Tony Soprano. You, the biometric holder, have no way of validating every reader. And in every case, a compromised biometric is of negative value to the owner. If your thumbprint data is stolen, copies of it can be made forever and you can never get it back. Your own thumbprint is now a liability, not an asset.

In contrast, a smart card does not divulge its secrets willingly. Smart cards do not require trust in the card reader nor in the merchant. The merchant issues a challenge to the card, collects the response, and ships both the challenge and response to the bank. The bank records the challenge, validates that the challenge was never authorized before, and then validates that the response matched the challenge according to the secret rules the bank placed inside the card at the time of issuance. If a card is lost, the bank marks it lost/stolen and never authorizes it again. If a duplicate challenge is made, the merchant presenting the duplicate can be immediately suspected of fraud.

A smart card is good security, but poor authentication. But a biometric datum is poor security, and not necessarily good authentication.