Slashdot Mirror
75% Use Same Password For Social Media & Email
wiredmikey writes "Over 250,000 user names, email addresses, and passwords used for social networking sites can easily be found online. A study of the data collected showed that 75 percent of social networking username and password samples collected online were identical to those used for email accounts. The password data was gathered from blogs, torrents, online collaboration services and other sources. It was found that 43 percent of the data was leaked from online collaboration tools while 21 percent of data was leaked from blog postings. Meanwhile, torrents and users of other social hubs were responsible for leaking 10 percent and 18 percent of user data respectively...."
As long as passwords remain the central method of authentication, this will continue.
So wait...how exactly did they get hold of passwords?
Living With a Nerd
Use firefox extension's password hasher (http://wijjo.com/PasswordHasher). Then you only need to remember one password but can use it for a variety of sites. If any one site's passwords get leaked, you dont have to go around an update your password for all other sites.
I don't care that I don't have all that much concern for facebook's password. If someone takes my account, it would be unfortunate, but is it really the end of the world?
Places where it might cause me economic misfortunate, well, those I care about, but everyone out there thinks that their site is so important for passwords.
Some places, it's important. Others, not so much.
Sarbonn's blog: http://www.sarbonn.com/blog
I'll give a bit of a hint here, I do the same thing, just with a slight variation:
Mostly-Trusted media sites get the same password (obviously vastly different user names)
Slashdot, Fark, Broadband Reports, etc
Then I have my pseudo-trusted sites with their own password group:
Demonoid, imageshack, probably others.
Non-trusted sites get a random junk password each access = reset password
ie: low accountability not tied to a company name with 2-3 visits/year
My email gets its own password of 10+ characters
Work gets its own password of whatever the hell rules they implement this week. Tech support has to deal with LOTS of reset requests since I don't write it down, but they have a different password for every freaking service and every freaking service has a different password lifetime setting.
So aside from work, I really only have 3 passwords or so, but it helps break up the damage should one be compromised. Compartmentalized is probably the best description.
Out of modpoints but really liked a post? 1BDkF6TtmmeZ3yqXbz9yhdYVqRYnwFoXDj
Furthermore, since the passwords are seemingly random characters (not words, or anything sensable) - they are generally quite strong.
"pwdhash" is the foremost system for doing this - there are several browser extensions and other tools for automating it
See: http://cynix.org/tools/superpwdhash
Apparently 75% of the passwords tested were hunter2.
They say a little knowledge is a dangerous thing, but it's not one half so bad as a lot of ignorance. - Terry Pratchett
When it comes to passwords, this dilbert comic comes to mind- http://dilbert.com/strips/comic/2007-01-17/
Hah, my worst enemy is a system where a password has to have:
- at least two uppercase letters
- at least two lowercase letters
- at least two numbers
- at least two symbols
- at least 12 characters
- no characters that repeat
- nothing that's in your personal records
- nothing from the dictionary that's over three characters
- nothing from a FOREIGN dictionary that's over three characters
- at least three characters different from your last 10 passwords
No joke, I used a system for years that had those exact password requirements. Worse yet, I had to SUPPORT this system. Sometimes it would take a half hour for me to help someone figure out a new password.
There is a danger in creating a password system with two many requirements, because I know very few people who used that system who didn't have their password on a sticky note on their monitor.
Help me fix my brother's injured butt!
Facebook's founder knows the importance of social media:
So in this case, the victims didn't even have the same password, but accidentally used the email password for Facebook. Combined with a malicious site (which Facebook was for them) this can lead to leaked passwords.
The best solution to this is to use a password manager like 1password, roboform or KeepassX. I find 1password useful because it matches my password with the domain, preventing inadvertent entries. It's also a boon if you are developing with dozens of test and staging sites which change passwords often.
Make sure everyone's vote counts: Verified Voting
but there's no reason why you can't have your own hash function in your head
take a root password, say "penguin"
say you are creating a password for slashdot
so your password for slashdot is "penguinslashdot"
but for gmail its "penguingmail"
this is an extremely simplistic algorithm. i'm just using it as an example to show you: remember a PASSWORD GENERATING ALGORITHM, not a password. then you have a unique password for every site, but you don't have to remember 500 different passwords
a REAL algorithm could be something like "the first letter of my root password plus the third letter of the website name's ascii character value plus 3 divided by my home phone number as a kid plus the second letter of my root password plus... etc"
or whatever
the actual password used for each site can be quite variable and the algorithm can still be hard to guess even with a hacker who knows three or four such passwords
the point is: you don't need to remember a password, you need to remember a password creating ALGORITHM, in your head, that only you know, which is infinitely more secure, but no harder to remember
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
What if they are gay? ;)
That's why his usernames are all something along the lines of "IAM_NOT_GAY"
It's a sort of psychosexual firewall. Only someone who can embrace being gay and not gay at once may pass.
Or Pat.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I use a set of passwords for varying levels of trust.
Highly secure passwords (usually site specific and follow good password rules) for banking, email, computer accounts, etc.
Medium secure passwords (usually follow good password rules but passwords may be used for more than one site) for trusted shopping sites (i.e. Amazon, etc.)
Medium-Low secure passwords (may not follow good password rules but still reasonably secure against dictionary attacks) for social media and for one-off shopping sites.
Low secure passwords (probably only stops low-motivated hackers, passwords re-used at multiple sites) for throw-away registrations and communities that have very little tie to my personal information
It's really more for convenience than security, but in areas where I need the security, I'll put up with the hassle.