Slashdot Mirror
75% Use Same Password For Social Media & Email
wiredmikey writes "Over 250,000 user names, email addresses, and passwords used for social networking sites can easily be found online. A study of the data collected showed that 75 percent of social networking username and password samples collected online were identical to those used for email accounts. The password data was gathered from blogs, torrents, online collaboration services and other sources. It was found that 43 percent of the data was leaked from online collaboration tools while 21 percent of data was leaked from blog postings. Meanwhile, torrents and users of other social hubs were responsible for leaking 10 percent and 18 percent of user data respectively...."
As long as passwords remain the central method of authentication, this will continue.
So wait...how exactly did they get hold of passwords?
Living With a Nerd
Use firefox extension's password hasher (http://wijjo.com/PasswordHasher). Then you only need to remember one password but can use it for a variety of sites. If any one site's passwords get leaked, you dont have to go around an update your password for all other sites.
I'd use the same password for everything if they all had the same basic requirements.
I don't care that I don't have all that much concern for facebook's password. If someone takes my account, it would be unfortunate, but is it really the end of the world?
Places where it might cause me economic misfortunate, well, those I care about, but everyone out there thinks that their site is so important for passwords.
Some places, it's important. Others, not so much.
Sarbonn's blog: http://www.sarbonn.com/blog
I'll give a bit of a hint here, I do the same thing, just with a slight variation:
Mostly-Trusted media sites get the same password (obviously vastly different user names)
Slashdot, Fark, Broadband Reports, etc
Then I have my pseudo-trusted sites with their own password group:
Demonoid, imageshack, probably others.
Non-trusted sites get a random junk password each access = reset password
ie: low accountability not tied to a company name with 2-3 visits/year
My email gets its own password of 10+ characters
Work gets its own password of whatever the hell rules they implement this week. Tech support has to deal with LOTS of reset requests since I don't write it down, but they have a different password for every freaking service and every freaking service has a different password lifetime setting.
So aside from work, I really only have 3 passwords or so, but it helps break up the damage should one be compromised. Compartmentalized is probably the best description.
Out of modpoints but really liked a post? 1BDkF6TtmmeZ3yqXbz9yhdYVqRYnwFoXDj
This password security paranoia drives me crazy. If someone wants your shit, they're going to get it. I'll tell you all right now, I have maybe 3 online handles that pop up everywhere. I use the same basic password for each (adding a 1 to the end on occasion where it's OMG REQUIRED). I'm sure if someone started googling me, they'd find out a lot. I wouldn't even be surprised if they could manage to dig up something years ago where I may have said something to someone and just given my password because they're a friend, or whatever. It's probably there, and it's probably there for you too. Failing that all they'd have to do is find all the places I exist, and try to find the least secure one/impersonate me/whatever.
I've lived this blasphemous insecure lifestyle on the internet for decades now, and have never once had an account compromised. Whether this is because I'm a worthless peon or because password security is bullshit is yet to be determined.
Moral of the story: be insignificant to the point that you're considered below the bad guys. Failing that, stop fucking worrying.
Furthermore, since the passwords are seemingly random characters (not words, or anything sensable) - they are generally quite strong.
"pwdhash" is the foremost system for doing this - there are several browser extensions and other tools for automating it
See: http://cynix.org/tools/superpwdhash
Apparently 75% of the passwords tested were hunter2.
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
I wondered how many people would see a registration form that requires an email address and a password, and interpret that to be asking them for their email password. Considering how many people fall for really atrociously bad phishing scams it wouldn't surprise me that a lot of people would give away their email passwords on registration forms either...
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
When it comes to passwords, this dilbert comic comes to mind- http://dilbert.com/strips/comic/2007-01-17/
Hah, my worst enemy is a system where a password has to have:
- at least two uppercase letters
- at least two lowercase letters
- at least two numbers
- at least two symbols
- at least 12 characters
- no characters that repeat
- nothing that's in your personal records
- nothing from the dictionary that's over three characters
- nothing from a FOREIGN dictionary that's over three characters
- at least three characters different from your last 10 passwords
No joke, I used a system for years that had those exact password requirements. Worse yet, I had to SUPPORT this system. Sometimes it would take a half hour for me to help someone figure out a new password.
There is a danger in creating a password system with two many requirements, because I know very few people who used that system who didn't have their password on a sticky note on their monitor.
Help me fix my brother's injured butt!
Facebook's founder knows the importance of social media:
So in this case, the victims didn't even have the same password, but accidentally used the email password for Facebook. Combined with a malicious site (which Facebook was for them) this can lead to leaked passwords.
The best solution to this is to use a password manager like 1password, roboform or KeepassX. I find 1password useful because it matches my password with the domain, preventing inadvertent entries. It's also a boon if you are developing with dozens of test and staging sites which change passwords often.
Make sure everyone's vote counts: Verified Voting
Password protect our bios
Then our Hard drive
Then our Operating System
Then our router
Then our ISP
Then our Email
Then our website
Then our credit / bank cards (pins and codes)
I'm all for it but the thing that bugs me is why cant we write a paragraph for our passwords or at the very least a full sentence.
usually 8-64 characters is the min max range for a acceptable password. But what If I want my password to be the gettysburg address. Or maybe just the lyrics to a song. Why cant we have insanely complex passwords if we want? So until my password can be pi to the 100th digit dont come complaining to me when my passwords are the same for everything.
but there's no reason why you can't have your own hash function in your head
take a root password, say "penguin"
say you are creating a password for slashdot
so your password for slashdot is "penguinslashdot"
but for gmail its "penguingmail"
this is an extremely simplistic algorithm. i'm just using it as an example to show you: remember a PASSWORD GENERATING ALGORITHM, not a password. then you have a unique password for every site, but you don't have to remember 500 different passwords
a REAL algorithm could be something like "the first letter of my root password plus the third letter of the website name's ascii character value plus 3 divided by my home phone number as a kid plus the second letter of my root password plus... etc"
or whatever
the actual password used for each site can be quite variable and the algorithm can still be hard to guess even with a hacker who knows three or four such passwords
the point is: you don't need to remember a password, you need to remember a password creating ALGORITHM, in your head, that only you know, which is infinitely more secure, but no harder to remember
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I've been involved with tech support, and have been asked for help from family and friends. Many non-computer savvy people see these registrations and think that they are *supposed* to use their email address password there. When people (including my mother) have asked me for help to setup for random online accounts where they give their Yahoo email address (for example), they frequently ask, "so I should put my yahoo password in here?"
Even if they realize it's a second password, they will often use the same one anyway, which is often something as simple as their own first name in all lowercase. I told one family member that this was a very bad idea, and that good passwords are a combination of letters and numbers, so she began adding 123 to the end of her passwords...
These people don't realize how some accounts *can* be abused. Sure, many of us take security for things like social media sites less seriously, but don't forget that having an insecure Facebook account opens the door for someone getting access to your account and bombarding everyone you know with things like porn spam, phishing schemes, links to infect people with malware, people posing as you to commit fraud (such as posing as you to ask people for financial assistance for some personal emergency), or social sabotage.
Passwords are a mess, in general. Only a small minority exercise proper password security practices, there are too many sites that require passwords, and even those that of us that want to practice good password security (and realize the importance of it) are burdened with the mess of having 30 different logins and passwords for different sites.
What if they are gay? ;)
That's why his usernames are all something along the lines of "IAM_NOT_GAY"
It's a sort of psychosexual firewall. Only someone who can embrace being gay and not gay at once may pass.
Or Pat.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Many people are going on about how they use a password manager or a hasher or some such which supposedly solves this problem of remebering passwords, but all they've really done is substitute one inconvenience for another. The reason people use one password everywhere is *convenience*. They do not want to remember a bunch of different passwords, or worse, forget them! Sure a password manager prevents that when you are at your computer, but now it's almost impossible to login unless you have your computer in front of you, which could be extremely inconvenient under certain circumstances, for example if you need to access an email while visiting family for dinner and didn't bring your laptop, or if you lose your computer.
People who use one password for everything are not going to stop unless a more convenient option arises, which is unlikely to occur. I guess the people who steal passwords will always have a job!