Slashdot Mirror
Yep, People Are Still Using '123456' and 'Password' As Passwords In 2014
Nerval's Lobster writes "Earlier this week, SplashData released its annual list of the 25 most common passwords used on the Internet — and no surprise, most are so blindingly obvious it's a shock that people still rely on them to protect their data: '12345,' 'password,' 'qwerty' '11111,' and worse. There were some interesting quirks in the dataset, however. Following a massive security breach in late 2013, a large amount of Adobe users' passwords leaked onto the broader Web; many of those users based their password on either 'Adobe' or 'Photoshop,' which are terms (along with the ever-popular 'password') easily discoverable using today's hacker tools. 'Seeing passwords like "adobe123" and "photoshop" on this list offers a good reminder not to base your password on the name of the website or application you are accessing,' Morgan Slain, CEO of SplashData, wrote in a statement. Slashdotters have known for years that while it's always tempting to create a password that's easy to remember — especially if you maintain profiles on multiple online services — the consequences of an attacker breaking into your accounts are potentially devastating."
If your password for Adobe is Adobe123, and Adobe leaks your password (AGAIN), nobody is going to be getting into your email, or your facebook account, or your bank account, etc., etc.
Repetition does not transform a lie into the truth. - FDR
Many of the accounts you are forced to create nowadays are for the benefit of whoever wants to track you, not for your own benefit. When I was forced to sign up for an Apple Developer or iTunes Store account to get software updates for my MacBook I hoped there would be a pool of shared profiles people had set up for anybody to re-use, but not finding them I assume Apple detects and de-activates them.
I knew it was a good idea to change my password to 'dvorak'.
Coder's Stone: The programming language quick ref for iPad
Quoth, "It's a shock that people still rely on them to protect their data".
Important fact that many of these studies miss: not everybody cares about their data, and not all data is the same. Anyone using a password like this to protect their bank account, or their email address (that they use to send forgotten password requests from their bank account) deserves to have their money stolen.
On the other hand, anyone who uses a password like this to protect the fact that they once logged into some random crappy site that they joined to post one comment, and which they have subsequently never used again and have forgotten about, deserves... absolutely nothing bad to happen to them as a result. Who cares if someone gets their password to some random crappy site? I certainly don't. It would be a much worse idea to use a more secure password to those throwaway sites, because then you'd be tempted to use the same password you used on more secure sites you actually cared about.
There are probably a lot of passwords to throwaway sites like that in any database of stolen passwords, specifically because people are more likely to use better passwords on the sorts of sites that are also (I certainly hope!) less likely to get all their passwords leaked.
Create a password: password
Everyone is using "password." We need to stop that.
Create a password containing both letters and numbers: password1
Everyone is using "password1." We need to stop that.
Create a password containing numbers and both capital and lowercase letters: Password1
Everyone is using "Password1." We need to stop that.
Create a password containing numbers, both capital and lowercase letters and a special symbol: Password1!
And so it goes.
Because you can't fix stupid and you can't fight indifference. Neither one dares and battling that is like pushing string.
That's the same combination that luggage jokes use.
Considering the internet is still used by the same set of people from 2013, and 2012, and 2011, etc, it shouldn't be surprising they're using the same kinds of crappy passwords.
Better known as 318230.
...that the decision to use such a password (or perhaps more correctly, the lack of a decision to utilize a good password) would usually just be a response to either a necessity or else a merely common convention of having one in a given context, and not out of any expectation that it actually offer any real protection for anything.
File under 'M' for 'Manic ranting'
http://xkcd.com/936/
Obligatory: I can memorize two dozen different randomly generated 20 char passwords and you can too
Obligatory: XKCD's solution is so insecure, anybody can crack his code using brute force
A site like Adobe, if I had to have an account there for some reason, would have no relationship to other accounts, would need no particular security because it would be unimportant, and even remembering a password would be too much bother.
Now Slashdot, my password for that is important, it's *************8**
time to change your password!
Let's call it what it is. It is not a list of the most common passwords used on the internet. It is a list of the most common passwords used at Adobe,.. maybe. They don't know what the Adobe passwords are right now. They cannot know all the passwords used on the internet, so they cannot know the most common ones used on the internet. It's a bullshit article written for morons.
Proverbs 21:19
Of course they do. Anyone surprised?
One of the reasons (one, it's a complex topic) is that we, the security professionals, are too dense to properly explain things in a language the user understands correctly.
For example, we tell them their password should be difficult to guess. But "guess" is the entirely wrong word to use, because it implies something that's not happening in the real world. When you say "guess" to a normal person, his mental image is that of some attacker thinking there, trying a few different things. What we experts mean is that some script will do 10,000 login attempts with a dictionary attack, or some hacker will check your pilfered password hash against a rainbow table.
Quite a few regular users are seriously convinced that "123456" is a "hard to guess" password, because it wouldn't be their first or second guess for someone elses password.
Here's what you need to do, IMNSHO:
We've had several of these breaches with leaked passwords over the years. Collect them, take the top 10,000 or so passwords and put them into a list. Add that list to John with a simple (because you want to be fast) ruleset for permutations. When the user picks a password, run that in the background. And instead of telling him to use a "difficult to guess" password, tell him that you run the same program that some evil people use, and if it can crack his password, he needs to use a different one.
Tell him that John needed 0.0253 (or whatever) seconds to crack his password, and show him the rule so he understands (e.g. "passw0rd" is a permutation of "password", the #2 most often used password).
It'll take 20 minutes for him to find a password that works, and he'll have to write it down to remember it. Problem solv... oh, wait...
Maybe, you know, the problem is in the method. Passwords suck.
Assorted stuff I do sometimes: Lemuria.org
[face palm]
While it's true that a complex and perhaps unique password is an important element of security, it is *not* true that there is always something worth protecting. I don't mind using trivial passwords on services if I will only use the service once, and there are no consequences to the account being compromised.
We should take these statistics with a similar note of caution. Just because someone chooses a weak password for something, does not imply that that user is making a mistake - indeed, the user could know something that we don't, like that the account in question is throw-away.
When this happens, it is the service provider, whose services may be abused, rather than the user, who may be at risk.
...my carefully prepared memo on commonly-used passwords. Now, then, as I so meticulously pointed out, the four most-used passwords are: love, sex, secret, and god.
My password was Edoba123 !
Ha! Capitalization, numbers, and a non dictionary word! STRONG PASSWORD!
I am so smrt!
People make lots of throwaway accounts because every company wants to force people to register, so it's not surprising you keep seeing generic passwords used. Adobe has downloads that you have to register to get, so it's not surprising seeing lots of generic, insecure passwords. I imagine for a lot of these accounts, all you will get is a fake name, throwaway email address, and what was downloaded.
My password today for mundane sites is: all those asshats that think they are so smart 123!"#
(numbers and special characters added for sites that requires them)
What do you expect to be the *most common* passwords used? Something like "nx4897)(/)hahaha98@79"? Would be more interesting to know *how often* simple passwords are used. If the highest percentage of a single weak password in use was about 0.0001%, everything should be fine. But if >=10% of all passwords used were a weak, that would be bad...
You may be able to brute force 256*8 numbers, but never the whole unicode range. (pässwörd)
https://xkcd.com/936/
Shoes for Industry. Shoes for the Dead.
my cat's name is &%GRang876$%#lkkjhaeyluihjsdkaClghiu.
What sort of site is storing their passwords in plaintext to allow this study to be done? Probably the crappy sites that people use throwaway passwords on. Value of study? zero.
I'm guessing the guys who picked those passwords is about as competent as that guy in that jpeg on the second link. He's trying to use a key to unlock a laptop and wears a mask so the monitor can't tell who he is.
while
Let's be honest, we would still be mocking them if they used passwords shorter than 18 characters and/or any dictionary words.
Unless they a unique 18 character high entropy password for each of their sensitive accounts then obviously they are stupid and/or lazy.
For every site you are requested to come up with a random string that is hard to remember, and then remember it.
Don't append 123 to the website name to create a password. Instead append Scunthorpe, this will cause the Great Firewall of the UK to protect your data.
One of my passwords is 63 characters long.
Though it is a combination of seven other different passwords.
Websites, corporate domains, and so on, still allow "password" and "123456".
You can't use these silly passwords if there is a password-strength check that was set up with a bit of common sense.
Like the open source one currently being developed by the Hackaday readers.... http://hackaday.com/tag/developed-on-hackaday/
every suggestion is by the way very welcome...
i'm going to use '123456' from now on. If somebody is knocking doors with that password, odds are they will access else's account before mine.
Trust me, the NSA uses statistics and not fuzzy logic. Trust me, in the general case, it's an entropy leak. As someone with apg-generated unique passwords for every place I visit (as short as 10 characters if I really don't give a shit) I might have one such password in my portfolio, but it would be a joke, a highly self-conscious joke. It's still an entropy leak. I'm sure the NSA has a special folder for people with my sense of humour.
Now to trash on the story summary.
And worse than "password"? Oh, please. In the most contrived example, you might find a way. But generally, "password" has a death grip on most worstest. Just couldn't resist tacking on the rubber-necker woot-woot, could you?
This is why I use PasswordMaker. I get a separate, secure password for every site, only have to remember a single password, (and a simple configuration) and don't have a list of passwords stored anywhere.
I'm constantly advocating for it yet nobody ever listens to me...
...Had this been an actual emergency, we would have fled in terror, and you would not have been informed.
In general you're never going to stop this. People (most) when it comes to selecting multiple usernames and passwords are sick of it. They become tired of the tedious requirements of managing over 100 sites of passwords and the others are just too lazy to care.
" Slashdotters have known for years that while it's always tempting to create a password that's easy to remember "
Yes it's temping, and you should do it. Just becasue it's easy to remember doesn't mean it's easy to crack. Example:
Street I lived on when I was a kid:
Parakeet
Name of my first pet:
Toby
This is easi informaiton for me to rememberm but not information that random,e p[eople would know, in fact Oyther than my immediat family, no one would know.
So:
P4r4k33t_T0by_A
Rotate the A
I would never forget that. NO, it' s NOT what I used, but I do use a similar technique.
Want a harder one. fine.
yb0T_t33k4r4P_a
The Kruger Dunning explains most post on
The reason passwords suck is: This one wants eight characters, with a symbol and letter This one wants eight characters, with NO symbols, and a letter This one wants upper and lower case letters This one wants upper and lower case with a symbol and number This one want upper and lower with no symbols. The formats change all the time, so it is no wonder that most people end up with a post it note stuck to the computer, or if stealthy, inside the draw.
They cracked my password. Now I'll have to change my dog's name again.
Have gnu, will travel.
What's the bigger problem here - that people choose insecure passwords, or that the systems involved ALLOW them to choose known insecure passwords? Any password system these days should be able to disallow these common passwords out of the gate. If they can't be bothered to make sure their customer's password is difficult to crack, how can we believe that any other aspect of their security is up to par? I would note that most of the password leaks have come from folks that use insecure methods to hash or simply obscure their password storage, against all recommendations by the security industry.
Fixed that title for you.
Passwords are fucking bullshit and need to die.
Passphrases would be far, far better.
A key-based system (ala SSH) would be best.
I have started using lastpass's automagic password creation doodah to randomly generate my passwords, I am of course (foolishly) trusting them to stay in business for the rest of my life and paying the measly $10 / sorry, now $12pa to keep them "safe". Is that safer than using the same memorable passwords (tiered for banking/work stuff/forum spamming/unimportant stuff) variations on the same theme just to memorise them? I dont know, SSO in a way but there comes a point in life where it all becomes too many to remember. What to do? For example, World of tanks did not allow me to use non alphabetic characters FFS, unbelievable how many times I use their "reset my password" facility as I cant remember it. Might just get a big bunch of post-it notes and put them around the monitor like my Bosses do.
My password is ',.pyf you insensitive clod!
...analyze about 5,000 production passwords set by end users over the course of a year. All of these passwords could have passed cursory PCI-DSS muster since they were more than seven characters long and contained both numeric and alphanumeric characters. ...some users (2%) actually used the word “password” or “pass” in their password
http://resources.infosecinstitute.com/beyond-password-length-complexity/
Even to read some news site requires that you go through the stupid account creation process. I doubt that most are using these simple passwords for anything important, just for the stupid sites who are so full of their own self importance that the creators believe that at some stage in the future a huge corporation i going to offer them $100M for their database of users.
Look, I bought a box to hook up to my tv to watch youtube on my tv. It requires me to enter a google email address. Well, I did not want to use my usual email address. What if I give the box to somebody Do I have to spend an hour trying to delete my account details from the stupid thing? So I did what everybody else does. I spent half an hour creating YET ANOTHER F*CKING GOOGLE ACCOUNT with a fake name and simple password (123456 or something like that so just so that I could use the thing.
If you try to watch "Tayo The Little Bus" it asks you to sign in because apparently some idiot user has marked it as not "Age Appropriate" or some other nanny state BS like that.
That is why there are so many "easy" passwords. Because the idiots in charge have created a situation where we have to have so many passwords.
You can't protect people from their own stupidity
The problem is that then Google, Facebook, Twitter, Yahoo or OpenID would know every site you are authenticating yourself to. To use those services you have no choice but to trust them with that information. Which they will use for their own nefarious purposes (read: collect into giant database and sell to dozens of other companies and gov't organizations).
The worst I've seen in terms of potential risk was the admin password on a customer's primary firewall cluster. It was the same one I had used in class for the labs when I taught it, even though I'd admonished the students not to ever use such a weak password. It was qaz123.
I had another client using a different firewall vendor who used q1w2e3r4t5. On their production Internet gateway.
There have been a few websites that I have used in the past which required you to register with them in order to access some part of the site or to access the download area. For sites like this I could see people using weak passwords, because the account has no particular value to them and they don't care if the account gets hacked.
Adobe is a good example of this. Most of those accounts were probably created for a one-time access to free downloads from adobe, and then promptly forgotten about.
The built-in automatic password for a certain banking transaction history system used for the equivalent of "root" access is "MMDD". Four easily predicted digits.
And this software is used by some of the biggest banks in North America -- several of them. It's used to maintain complete seven year transaction histories in compliance with the law and banking regulations.
Worse, there is no audit trail of the account used to access the emergency maintenance account. And you cannot disable the account!
I do not fail; I succeed at finding out what does not work.
you slashdot are a security risk
No, people still rely on them to get passed password prompts protecting data they don't care about.
no?
Really?
why they fuck does my email have the ability and the use of a stronger password system than my bank? Not talking about making 255 charter high ascii stuff here just minimum length, with the ability to toss a ? or a { in the mix...
Bruce Schneier has Password Safe. There's KeepassX and many others. I personally use that because programs for reading them are available for all the platforms I care about: Linux, Windows, and Android.
Guys just sharing, I've found this interesting! Check it out! Http://www.2tasks.com
why they fuck does my email have the ability and the use of a stronger password system than my bank? Not talking about making 255 charter high ascii stuff here just minimum length, with the ability to toss a ? or a { in the mix...
I'd be asking why your bank isn't using 2 factor authentication.
/.ers rubbing their hands with glee telling me how this system is flawed, yep, I'm sure it's got flaws but it's a hell of a lot more secure than just a username and password. A thief now has to get my username and password _AND_ steal my phone or know me well enough to fraudulently transfer my phone no into their name (which is getting harder and harder for letterbox thieves as I have few paper bills now days).
If anyone gets my banking username and password all they can do is look at my modest bank account. If they try to do anything then the bank sends a one time code to my phone via SMS and they cant do anything without that code. They cant even read my transaction history without a one time code.
I'm sure there are some pedantic
This is also why I dont use banking apps. They store details and many banks emphatically trust them. So all a thief has to do is swipe my phone and they get full access... If I used them that is. Web sites work just as well (often have more functionality too) and mr phone thief only gets my aging handset and what little credit is left on there.
Calling someone a "hater" only means you can not rationally rebut their argument.
... requiring to choose a password is too damn high. At least not on Slashdot, unless you want your comments to be read ;-)
If your password for Adobe is Adobe123, and Adobe leaks your password (AGAIN), nobody is going to be getting into your email, or your facebook account, or your bank account, etc., etc.
And this is insightful? That applies if your passwords for those accounts aren't 123456 or password, even using your address, date of birth, the brand of your vehicle, Maiden name/s, ect.....
All are just as easy to obtain nowadays.... Follow what security experts say when changing from caps to small caps, using numbers or using symbols in combination. All mine are different and there written down in a small analog [aka paper] notebook, nowhere near any of my computers. After awhile you begin to remember them.
I was fed up with password hell so came up with this solution - it's not perfect but it does work...
1.Think of a song lyric such as "Welcome to the house of fun" (Madness)
2.Think of this as "wtthof" (the initial letters)
3.Extrapolate a letter for a number. In this case "to = 2". So we now have "w2thof".
4.Some sites require 8 letters so (at this stage) we need at least 7 letters (we only have 6 right now). The word "Welcome" could be "wc" instead of just "w". So we now have "wc2thof".
5.Finally, take the first letter of the website you want log in to, "F" for Facebook, "E" for eBay etc and add a capital of that letter to the front of the password.
So, Facebook password would be "Fwc2thof"
Ebay password would be "Ewc2thof"
This gives up to 26 different passwords that cover all the rules and is easy to remember (WelCome 2 The House Of Fun)
If the website name starts with a number (such as 123-reg.com), keep the original rule (the first letter) but make the last letter a capital. This would make "1wc2thoF
I'd still like a simple GPG key I can use with websites for authentication. Server send me a challenge, I use my secret key to decrypt, logged in!
Other than that, I think, the whole password issue, aside from being a PITA, is one big smokescreen given recent revelations. The fact is, while some people will be affected, in reality most people will not be, even if they have pretty 'weak' passwords!
I skip all the vowels, then assign an integer to each consonant, p is 1, s is 2, w is 4, r is 5 and d is 6. If a letter is repeated I add 1 to the original integer. So now password is 123456, and I fooled all the bad guys.
-- Make America hate again!
I certainly hope Splashdata isn't reading passwords from SplashID users who store their SplashID data in Splash's servers. For your convenience in backing up and restoring, etc, of course.
The "Civilized World" jumped the shark ca. 1973.
I wonder how many of these accounts are those created by forum posting bots. It would interesting to see the relative statistics.
When I was forced to sign up for an Apple Developer or iTunes Store account to get software updates for my MacBook...
You do not have to sign up for any kind of online account to get software updates for a Mac.
I have a different random password for every website on which I have an account. Relatively hard to crack with brute force. The problem is that as a user, I have no idea what the website is doing under the hood - they could be storing it in cleartext for all I know. But with a different password for every website I visit, even this possibility isn't something I lose much sleep over.
...let's all post our passwords here and see who has the best one. Go!
is the password I would use if Slashdot forced me to create an account for commenting, and I would post it to bugmenot so other people can be AC too. People will always use weak passwords for throwaway accounts. There's nothing wrong with that.
That's my password. ********. The problem is i can't get it not to display.
Star Trek transporters are just 3d printers.
My Slashdot password of slashdot123 is on that list.