Slashdot Mirror
75% Use Same Password For Social Media & Email
wiredmikey writes "Over 250,000 user names, email addresses, and passwords used for social networking sites can easily be found online. A study of the data collected showed that 75 percent of social networking username and password samples collected online were identical to those used for email accounts. The password data was gathered from blogs, torrents, online collaboration services and other sources. It was found that 43 percent of the data was leaked from online collaboration tools while 21 percent of data was leaked from blog postings. Meanwhile, torrents and users of other social hubs were responsible for leaking 10 percent and 18 percent of user data respectively...."
As long as passwords remain the central method of authentication, this will continue.
So wait...how exactly did they get hold of passwords?
Living With a Nerd
Use firefox extension's password hasher (http://wijjo.com/PasswordHasher). Then you only need to remember one password but can use it for a variety of sites. If any one site's passwords get leaked, you dont have to go around an update your password for all other sites.
I'd use the same password for everything if they all had the same basic requirements.
I don't care that I don't have all that much concern for facebook's password. If someone takes my account, it would be unfortunate, but is it really the end of the world?
Places where it might cause me economic misfortunate, well, those I care about, but everyone out there thinks that their site is so important for passwords.
Some places, it's important. Others, not so much.
Sarbonn's blog: http://www.sarbonn.com/blog
I'll give a bit of a hint here, I do the same thing, just with a slight variation:
Mostly-Trusted media sites get the same password (obviously vastly different user names)
Slashdot, Fark, Broadband Reports, etc
Then I have my pseudo-trusted sites with their own password group:
Demonoid, imageshack, probably others.
Non-trusted sites get a random junk password each access = reset password
ie: low accountability not tied to a company name with 2-3 visits/year
My email gets its own password of 10+ characters
Work gets its own password of whatever the hell rules they implement this week. Tech support has to deal with LOTS of reset requests since I don't write it down, but they have a different password for every freaking service and every freaking service has a different password lifetime setting.
So aside from work, I really only have 3 passwords or so, but it helps break up the damage should one be compromised. Compartmentalized is probably the best description.
Out of modpoints but really liked a post? 1BDkF6TtmmeZ3yqXbz9yhdYVqRYnwFoXDj
This password security paranoia drives me crazy. If someone wants your shit, they're going to get it. I'll tell you all right now, I have maybe 3 online handles that pop up everywhere. I use the same basic password for each (adding a 1 to the end on occasion where it's OMG REQUIRED). I'm sure if someone started googling me, they'd find out a lot. I wouldn't even be surprised if they could manage to dig up something years ago where I may have said something to someone and just given my password because they're a friend, or whatever. It's probably there, and it's probably there for you too. Failing that all they'd have to do is find all the places I exist, and try to find the least secure one/impersonate me/whatever.
I've lived this blasphemous insecure lifestyle on the internet for decades now, and have never once had an account compromised. Whether this is because I'm a worthless peon or because password security is bullshit is yet to be determined.
Moral of the story: be insignificant to the point that you're considered below the bad guys. Failing that, stop fucking worrying.
Furthermore, since the passwords are seemingly random characters (not words, or anything sensable) - they are generally quite strong.
"pwdhash" is the foremost system for doing this - there are several browser extensions and other tools for automating it
See: http://cynix.org/tools/superpwdhash
Apparently 75% of the passwords tested were hunter2.
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
The average Joe has no clue or concept of security or the capabilities of hackers. They usually set a really easy password and use it everywhere.
This will not stop until there are technologies that can determine that the link you are clicking on in the e-mail is not the site you are intending to go to. To ask a standard user to use Thunderbird or another product that shows the hyperlink when you put your mouse over it is naive.
As long as there is a lot of money to be made hacking into the minion's PCs it will continue on. Hopefully they will be educated in school and over time it diminishes, but they are quite resourceful, the hackers are.
I wondered how many people would see a registration form that requires an email address and a password, and interpret that to be asking them for their email password. Considering how many people fall for really atrociously bad phishing scams it wouldn't surprise me that a lot of people would give away their email passwords on registration forms either...
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
When it comes to passwords, this dilbert comic comes to mind- http://dilbert.com/strips/comic/2007-01-17/
Hah, my worst enemy is a system where a password has to have:
- at least two uppercase letters
- at least two lowercase letters
- at least two numbers
- at least two symbols
- at least 12 characters
- no characters that repeat
- nothing that's in your personal records
- nothing from the dictionary that's over three characters
- nothing from a FOREIGN dictionary that's over three characters
- at least three characters different from your last 10 passwords
No joke, I used a system for years that had those exact password requirements. Worse yet, I had to SUPPORT this system. Sometimes it would take a half hour for me to help someone figure out a new password.
There is a danger in creating a password system with two many requirements, because I know very few people who used that system who didn't have their password on a sticky note on their monitor.
Help me fix my brother's injured butt!
Facebook's founder knows the importance of social media:
So in this case, the victims didn't even have the same password, but accidentally used the email password for Facebook. Combined with a malicious site (which Facebook was for them) this can lead to leaked passwords.
The best solution to this is to use a password manager like 1password, roboform or KeepassX. I find 1password useful because it matches my password with the domain, preventing inadvertent entries. It's also a boon if you are developing with dozens of test and staging sites which change passwords often.
Make sure everyone's vote counts: Verified Voting
When you try to sign up for a site, it could try to login to the email you give it using the password you provide, assuming it supports a standard protocol or is a well-known site. If it succeeds, it can reject the chosen password.
Lots of comments talk about password hashing, but where's the discussion on OpenID? You decide who proves that you are you, and how. Facebook Connect really needs to die and give way to email-based authentication (such as using your gmail/ymail as an openID).
thats all I care to remember. One for critical things (like work email, anything requiring a #CC), one for semi-important things (like gmail account), and one where I don't really care if it gets hax0rd (slashdot, reddit etc).
Yes I do have various different logins for work vpns and servers, this is more for personal type stuff.
http://www.malwarecity.com/blog/the-limits-of-privacy-is-this-your-password-865.html
Emotions! In your brain!
Time to go add a '1' at the end of my email password, be right back...
Tired of my customary (Score:1)
Password protect our bios
Then our Hard drive
Then our Operating System
Then our router
Then our ISP
Then our Email
Then our website
Then our credit / bank cards (pins and codes)
I'm all for it but the thing that bugs me is why cant we write a paragraph for our passwords or at the very least a full sentence.
usually 8-64 characters is the min max range for a acceptable password. But what If I want my password to be the gettysburg address. Or maybe just the lyrics to a song. Why cant we have insanely complex passwords if we want? So until my password can be pi to the 100th digit dont come complaining to me when my passwords are the same for everything.
* Generate a unique 63 random ASCII characters passwords with https://www.grc.com/passwords.htm for EVERYTHING
* Memorize them all. No writing down, no password keeping software, no re-rolling for easier passwords to memorize.
* 7 proxies, VPN, no items, fox only, final destination
I have the same password everywhere, but I use SuperGenPass so really I don't. I only have to REMEMBER one password, but what gets sent in to each site is different and looks like mWIfG7QG or something like that.
That's why i have my own password policy. For stupid things like social sites, garbage emails, "required" registrations for something, etc, i use WEAK password generator. (my slashdot accoint has weak password too, lol). For company accounts, i use INTERMEDIATE. And finally, for my own computer, emails, and other private accounts, i use very STRONG password policy. Btw, the best password you could imagine of is some sentence, or even a poem, but written in some specific way, or even language... Can you guess my 100 characters long password in the neat future, keeping in mind that there is no written note of it?
but there's no reason why you can't have your own hash function in your head
take a root password, say "penguin"
say you are creating a password for slashdot
so your password for slashdot is "penguinslashdot"
but for gmail its "penguingmail"
this is an extremely simplistic algorithm. i'm just using it as an example to show you: remember a PASSWORD GENERATING ALGORITHM, not a password. then you have a unique password for every site, but you don't have to remember 500 different passwords
a REAL algorithm could be something like "the first letter of my root password plus the third letter of the website name's ascii character value plus 3 divided by my home phone number as a kid plus the second letter of my root password plus... etc"
or whatever
the actual password used for each site can be quite variable and the algorithm can still be hard to guess even with a hacker who knows three or four such passwords
the point is: you don't need to remember a password, you need to remember a password creating ALGORITHM, in your head, that only you know, which is infinitely more secure, but no harder to remember
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I've been involved with tech support, and have been asked for help from family and friends. Many non-computer savvy people see these registrations and think that they are *supposed* to use their email address password there. When people (including my mother) have asked me for help to setup for random online accounts where they give their Yahoo email address (for example), they frequently ask, "so I should put my yahoo password in here?"
Even if they realize it's a second password, they will often use the same one anyway, which is often something as simple as their own first name in all lowercase. I told one family member that this was a very bad idea, and that good passwords are a combination of letters and numbers, so she began adding 123 to the end of her passwords...
These people don't realize how some accounts *can* be abused. Sure, many of us take security for things like social media sites less seriously, but don't forget that having an insecure Facebook account opens the door for someone getting access to your account and bombarding everyone you know with things like porn spam, phishing schemes, links to infect people with malware, people posing as you to commit fraud (such as posing as you to ask people for financial assistance for some personal emergency), or social sabotage.
Passwords are a mess, in general. Only a small minority exercise proper password security practices, there are too many sites that require passwords, and even those that of us that want to practice good password security (and realize the importance of it) are burdened with the mess of having 30 different logins and passwords for different sites.
Remind me to change the password on my luggage!
...so little hope.
I use now 11 different combinations of 13 different passwords at work. A unique situation, yes.
But for personal, recreational access, I have only 16 different passwords for 22 different systems, from banking to email to social networks to my online servers. What a lot of fun. I have a list which is almost always obsolete, and keeping it in a PGP file is a nuisance. Teaching my wife how and where to open the file and get a password she hasn't used in months is no fun. She keeps a list of hers in the house. If they get into that, they got everything anyways.
I've been trying to use OpenID more, but it's not universal.
Oh, and when my eBay password got compromised a few years ago, I sat right down and change a BUNCH of other passwords... Just to be sure.
deleting the extra space after periods so i can stay relevant, yeah.
Why would I use different passwords? If one password is [stolen-guessed-hacked] everything is in jeopardy anyway. Our online security is a house of cards. I use one simple (for me, random for you) password at all these sites that have no personal data beyond an email address, another far more complex set for sites that have more information and a third for site that have financial or "real" data (my medical license, I am not a doctor or state account).
6.8SPC TR of 550, l xwind at 6, drift rt at 26" drops 77". AT has 503 ft-lbs at 1403 fps. FT 0.86
http://xkcd.com/538/
What if they are gay? ;)
That's why his usernames are all something along the lines of "IAM_NOT_GAY"
It's a sort of psychosexual firewall. Only someone who can embrace being gay and not gay at once may pass.
Or Pat.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
12345, same as my luggage. Lots easier to remember.
Nick: Anonymous Coward
Password: IAMGAY
Login for "Anonymous Coward" has failed. Please try again.
Many people are going on about how they use a password manager or a hasher or some such which supposedly solves this problem of remebering passwords, but all they've really done is substitute one inconvenience for another. The reason people use one password everywhere is *convenience*. They do not want to remember a bunch of different passwords, or worse, forget them! Sure a password manager prevents that when you are at your computer, but now it's almost impossible to login unless you have your computer in front of you, which could be extremely inconvenient under certain circumstances, for example if you need to access an email while visiting family for dinner and didn't bring your laptop, or if you lose your computer.
People who use one password for everything are not going to stop unless a more convenient option arises, which is unlikely to occur. I guess the people who steal passwords will always have a job!
The average user does not understand security and the same password for everything makes it convenient. The problem is if you get someones password and you can get to sites like Amazon or ebay where you can really cause issues. People should use different passwords but they feel that's to much to remember or they will leave a password list laying around. Either way it's not secure and people can get hacked.
http://www.thetechnologygeek.org
Some trivia: on a site with domain XXXXXX.at roughly 0.5% of the registered users use XXXXXX as password (censored).
"I love my job, but I hate talking to people like you" (Freddie Mercury)
I've had the same lame password for slashdot since I've opened the account. I've had no problems. Most of my friends know it. I use that password for MANY other things too. Not the bank account though, that one is never used anywhere else and, besides myself, only my wife knows it.
-- I have a private email server in my basement.
If it's good enough for my luggage, it's good enough for my planetary shielding system.
I've been involved with tech support, and have been asked for help from family and friends.
Can't we have a conversation, just once, without discussing them?
GENERATION O98346: The first time you see this, copy it into your sig and remove a random number from the generation. T
> Apparently 75% of the passwords tested were *******.
Well, at least it's easy to type...
I like to keep things secure so for e-mail I use 1234 as a password and for facebook I use 6789. No need to make it easy for someone to hax0r my accounts!
zosxavius photography
Bruce is absolutely right. Encourage people to write their passwords down. Tell them how to do so securely. Issue them little black books and tell them how to keep them secure.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Comment removed based on user account deletion
Comment removed based on user account deletion
Pick a pair of X'th letters.
Each site use the two Xth letters.
For instance if you use a password like "b@man1"
and you use the 3rd and 5th letter as your Xth letters
You password on amazon would be:
ab@man1o
Using the Xth letters to prefix and postfix your password. Other variations include doubling up on the front or back
aob@man1 or b@man1ao for example.
All the while your google password would be
olb@man1 or b@man1ol respectively.
Another variation uses the first vowel to pick what Xth letters you use adding more variety but easy enough to remember the method.
-=[ Who Is John Galt? ]=-
Did BitDefender mention what kind of tricks they used to to actually obtain the passwords? A test phishing attack? guessing the passwords based on user's info? I am just confused as to how passwords can be "found" online unless you use some intrusive method to obtain them, which borders on legality issues.
SSH and GPG use one password and key everywhere--and remote hosts can't compromise my key or password because they never receive them or store them.
Maybe it's time for a change with respect to the retarded password systems we have out there: GPGAuth.
There's no place like
People are stupid, we knew that. I use a different password for almost every site. I know many many people use the same password for every site, or use only a few passwords. No amount of bitching is going to get them to change something they don't want to. On the other hand, most people don't really have enough interesting to be attacked. "OOOhhh I got into his GMail, now I can read that email from K-Mart he got yesterday!"
Hat’s off. Well done, as we know that “hard work always pays off”, after a long struggle with sincere effort it’s done. --------- o The above statement is seen to be contradictory. The situation is very critical and need an experience complainer to resolve it. -------- o This conversation is going no where. It’s lacking the place of a good leader to head the things to come out on conclusion. Technology Details
Hat’s off. Well done, as we know that “hard work always pays off”, after a long struggle with sincere effort it’s done. Technology Details
I use the same password and username on most gibberish accounts, exactly for this purpose, i do not need a special name for some unimportant website i use for reference for this or that, as i really only need it to post a question or answer, where as the important ones all have their own system, following an easy guideline like my user name for hotmail is xxxxhotmail@hotmail.com and password usually has some of the website name too, so that they are all easy to remember yet all the same when it comes to remembering the algorithm.
The best password bar none is 'aardvark'. How could someone ever crack that?
The new right fascists are bilingual. They speak English and Bullshit.
uniquely suited to compromise this persons account
I've never heard it called that before!
I just checked in my PasswordSafe archive and I have 108 account entries, each with its own password.
What's your excuse?
Haven't read the full article, but given what the Slashdot summary says, it seems it's rather '75% of people careless enough to lose their email or facebook password somehow used the same one for the other service'.
This is significant, because I rather suspect that the people smart enough not to use the same password for both things are the same people smart enough _not to post that password on their fucking blog_ (the type of mechanism the summary suggests the survey authors used to gather the samples).
Why using your email password on any other account is particularly bad, and what to do about it if your password is stolen