Slashdot Mirror
75% Use Same Password For Social Media & Email
wiredmikey writes "Over 250,000 user names, email addresses, and passwords used for social networking sites can easily be found online. A study of the data collected showed that 75 percent of social networking username and password samples collected online were identical to those used for email accounts. The password data was gathered from blogs, torrents, online collaboration services and other sources. It was found that 43 percent of the data was leaked from online collaboration tools while 21 percent of data was leaked from blog postings. Meanwhile, torrents and users of other social hubs were responsible for leaking 10 percent and 18 percent of user data respectively...."
As long as passwords remain the central method of authentication, this will continue.
I'd use the same password for everything if they all had the same basic requirements.
And if you ever need to sign in from a computer that doesn't have firefox, and that extension, installed.....you are stuck.
I don't care that I don't have all that much concern for facebook's password. If someone takes my account, it would be unfortunate, but is it really the end of the world?
Places where it might cause me economic misfortunate, well, those I care about, but everyone out there thinks that their site is so important for passwords.
Some places, it's important. Others, not so much.
Sarbonn's blog: http://www.sarbonn.com/blog
This password security paranoia drives me crazy. If someone wants your shit, they're going to get it. I'll tell you all right now, I have maybe 3 online handles that pop up everywhere. I use the same basic password for each (adding a 1 to the end on occasion where it's OMG REQUIRED). I'm sure if someone started googling me, they'd find out a lot. I wouldn't even be surprised if they could manage to dig up something years ago where I may have said something to someone and just given my password because they're a friend, or whatever. It's probably there, and it's probably there for you too. Failing that all they'd have to do is find all the places I exist, and try to find the least secure one/impersonate me/whatever.
I've lived this blasphemous insecure lifestyle on the internet for decades now, and have never once had an account compromised. Whether this is because I'm a worthless peon or because password security is bullshit is yet to be determined.
Moral of the story: be insignificant to the point that you're considered below the bad guys. Failing that, stop fucking worrying.
It's pretty amazing just how much of the world is based on trust isn't it?
Warning: This sig is not thread safe. For more information see Slashdot's sig policy.
I wondered how many people would see a registration form that requires an email address and a password, and interpret that to be asking them for their email password. Considering how many people fall for really atrociously bad phishing scams it wouldn't surprise me that a lot of people would give away their email passwords on registration forms either...
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Hah, my worst enemy is a system where a password has to have:
- at least two uppercase letters
- at least two lowercase letters
- at least two numbers
- at least two symbols
- at least 12 characters
- no characters that repeat
- nothing that's in your personal records
- nothing from the dictionary that's over three characters
- nothing from a FOREIGN dictionary that's over three characters
- at least three characters different from your last 10 passwords
No joke, I used a system for years that had those exact password requirements. Worse yet, I had to SUPPORT this system. Sometimes it would take a half hour for me to help someone figure out a new password.
There is a danger in creating a password system with two many requirements, because I know very few people who used that system who didn't have their password on a sticky note on their monitor.
Help me fix my brother's injured butt!
In Tinfoil Hat Land, if you don't have FF installed, then it's likely not a computer you control*, and if it's a computer you don't control, then should you really be entering your password**?
* It must be a machine at work, friend or family member's house, public terminal like a coffee shop, public library, etc.
** If it's not your computer, you don't know who that computer has "been with". There could be key-loggers, cookie-trackers, syphilis. Who knows!?
It's pretty amazing just how much of the world is based on trust isn't it?
And it's equally tragic that it can't.
I don't think it's so much that people automatically trust each other, although that's certainly the case sometimes, it's more like it never occurs to too many people, unfortunately, that what they divulge could cause problems in the wrong hands.
For many years now, when someone asks me for information, my first thought is not to give the information, but to consider why I don't want to give it to that person. And I don't consider myself particularly paranoid with respect to what I share.
It gets tiring after awhile. Modern life in the 21st century requires a level of vigilance regarding information that probably never existed outside of the military, national security apparatus, law enforcement or some elements of business before a couple decades ago.
"Loose lips sink ships" was a common saying during World War II, but nowadays everyone must practice that level of vigilance over their own information all the time merely to be safe from criminals.
You are in a maze of twisty little passages, all alike.
It's pretty amazing just how much of the world is based on trust isn't it?
Especially since, at least in the US, we seem to have been making crime stories the prime entertainment for decades, and there's a lot of money made from fear mongering.
I think the whole driving/road system is based on trust and it works quite well. It's potentially a very dangerous environment where the penalties for being reckless are not as bad as the potential damage you can cause. And yet it somehow works.
Btw I have to agree with one of the posts above, having your password be very offensive usually prevents you from sharing it at all. I do have such a password somewhere, and was horrified when a friend of mine cracked it.
but there's no reason why you can't have your own hash function in your head
take a root password, say "penguin"
say you are creating a password for slashdot
so your password for slashdot is "penguinslashdot"
but for gmail its "penguingmail"
this is an extremely simplistic algorithm. i'm just using it as an example to show you: remember a PASSWORD GENERATING ALGORITHM, not a password. then you have a unique password for every site, but you don't have to remember 500 different passwords
a REAL algorithm could be something like "the first letter of my root password plus the third letter of the website name's ascii character value plus 3 divided by my home phone number as a kid plus the second letter of my root password plus... etc"
or whatever
the actual password used for each site can be quite variable and the algorithm can still be hard to guess even with a hacker who knows three or four such passwords
the point is: you don't need to remember a password, you need to remember a password creating ALGORITHM, in your head, that only you know, which is infinitely more secure, but no harder to remember
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
Same basic process, though different criteria for me:
Like the parent, it's really a matter of compartmentalization and damage control. If you don't own the system, it's not completely trustworthy. If it's your system, it's only modestly trustworthy. If you're doing something criminal/embarassing/stupid, it's better to leave all notes at the bottom of the Marianas trench.
Never confuse movement with action. --Hemingway
That sounds like an argument for why porn should NOT be put on bluray and in HD!
My abilities are only limited by my imagination
Many people are going on about how they use a password manager or a hasher or some such which supposedly solves this problem of remebering passwords, but all they've really done is substitute one inconvenience for another. The reason people use one password everywhere is *convenience*. They do not want to remember a bunch of different passwords, or worse, forget them! Sure a password manager prevents that when you are at your computer, but now it's almost impossible to login unless you have your computer in front of you, which could be extremely inconvenient under certain circumstances, for example if you need to access an email while visiting family for dinner and didn't bring your laptop, or if you lose your computer.
People who use one password for everything are not going to stop unless a more convenient option arises, which is unlikely to occur. I guess the people who steal passwords will always have a job!
I suspect it has more to to with the progression of concepts.
Weapons: I had a rock, then I had a sling, then I had a bow-and-arrow, now I have a gun. I'm still hitting a target with a projectile. I take an action, something moves in roughly direction I tell it to, person or thing on other side hopefully develops a hole or wound where I intended. The method of projection and controls have changed, but the concept is the same (ready, aim, fire, yay! hit, shit! miss, target dead, target wounded, target VERY PISSED OFF).
Transportation: I had feet, then I had shoes, then I had a horse, then I had a bicycle, then I had a car. Again, still moving about, going 2 kilometers and turning left just takes less time but is the same concept. I take an action, something moves in roughly direction I tell it to, I hopefully get where I wanted to go. The controls have changed (legs->reins->handlebar->steering wheel) but the concepts aren't different (go, stop, turn left, turn right, etc).
Computers. I "power up" my "PC" and "monitor" and wait for my "desktop" in "Windows" to appear so I can "drag" a "cursor" then "double-click" on an "icon" on my "monitor" with a "mouse" to "open a window" so I can use a "program" called a "word processor" to write a "document" that is "saved" on a "subfolder" on an "external storage device" called "E:\" so I can "eject" the device before I pull it from my "USB port" on the USB "hub" that is plugged into my "case" and give it to a friend who can't read it because he uses "Office" on a "Mac" and my computer runs "Windows" so I needed to save it using a different "format" but I want to make sure not to "format" the "external storage device" to change the "format" but to "reopen" it and save it with a different "extension" and "file type".
That sentence made perfect sense, right? Of course it did. To you. But that's a shitload of novel concepts that someone who hasn't spent at least a few months in front of a computer to absorb in one sitting, yes? And that's all to write one document and save it. Nothing complex at all.
Few of these concepts have a pre-computer meaning, and when they do the analogies are distant and vague. The keyboard is analogous to a typewriter, but lacks the immediacy of space or the tactile "I push a letter, hear a bang, letter is on the paper in front of me".
It's not only that computers are new, but that they are completely new. We're not going from handwritten paper to books. We're going from immediacy to abstraction, and doing different things, and trying to express what those things are with poor analogies to similar things we've done before.
Look at most humans in a court of law. Look at many people when confronted with an engine that needs to be rebuilt, or even oil that needs to be changed. Watchmaking? Woodworking? Carving? Rolling a Kayak? Aviation? Knitting? Skiing? There are a lot of things that look really complex until you take the time to understand them, then you understand that they ARE really complex but not in the ways you imagined, and that "the bits I thought were complex are simple, but the bits I thought didn't exist are fucking complex" feeling will cause your brain to occasionally slide to "OFF".
It's called "being overwhelmed with too much new information all at once, with no way for Ye Olde Monkey Brain to categorize it into the neat little categories it's been using for the last x years."
In the case of computers, particularly if it's something you have no personal interest in but are told by someone else you need to master it.
"This post contains words, known to the State of California to cause thought. Wash brain thoroughly after reading."