Slashdot Mirror
The Most Popular Passwords Are Still "123456" and "password"
BarbaraHudson writes: The Independent lists the most popular passwords for 2014, and once again, "123456" tops the list, followed by "password" and "12345" at #3 (lots of Spaceballs fans out there?) . "qwerty" still makes the list, but there are some new entries in the top 25, including "superman", "batman", and "696969". The passwords used were mostly from North American and Western European leaks.
My password is ',.pyf, you insensitive clod!
I thought the most popular password was just {enter}
People like this are rightfully called incompetent. Hopefully they're not multi-billion dollar companies.
mooltipass!
People are still on the majority idiots.
Thing is, 'password' is so common, no one will guess that I'm using it. I'm outfoxing the foxes!
As illustrated by Stanfordâ(TM)s password policy shuns one-size-fits-all security http://arstechnica.com/securit... via https://itservices.stanford.ed...
69 Dude!
The real question is why there were plaintext passwords to be leaked in the first place.
Who doesn't love that one?
hunter2. But I guess that all should appear as '*******' to you as it is encrypted.
That's the same combination I have on my luggage!
At least 123456 has one more digit.
But no Marvel characters?
1) Clearly bad passwords will be the most popular. Some people will blow off security and will pick a bad password.
2) There are no data in the article regarding how frequently these passwords are used.
3) There is no representation of what these passwords are protecting. Maybe these are passwords to something harmless like accounts in some children's game. In which case, who cares?
hackme didn't make the list?
"Love", "secret", "sex", but not in that order, necessarily, right? Yeah, but don't forget "god".
gbclrabu.
If only that were true. Sigh.
Ha!.. no one will ever guess that I use password123456
On my own computers behind a firewall. I consider use of the password password about the same as having none.
Because the media lost much of it's credibility a long time ago and because they keep fear mongering, people pay less attention to the news. What ends up happening is people don't react until they become a victim or someone close becomes a victim. Everybody thinks it happens to other people.
Anyone who works in retail can tell you, people be DUMB. The internet doesn't make people dumber, it just makes it easy for them to demonstrate it. The old way of demonstrating it, posting ignorant rants on Youtube or Usenet, was inefficient.
Hackers are simply streamlining the process to the point you don't have to do anything actively: If someone can log into your account with a 4KB file named 500_most_common_passwords.txt, you were offically suffering an outbreak of stupid when you set the password and everyone will shortly know it.
Marvel readers are obviously more intelligent. ;p :) )
(or the built-in punctuation of the names just lends itself to passwords... spider-man, ant-man, S.H.I.E.L.D
Actually that last one isn't a bad idea...
I got a kick out of this one.
(changing password now)
The article mentions this is based on sites compromised, I wonder if this list isn't to some extent self-selecting towards bad passwords. Lower value sites are more likely to be compromised than high value sites like Amazon or Google, and on low value sites people are much more likely to use garbage. Personally I use a pw database but still use junk passwords on sites when its irrelevant if the account were to be compromised.
Really. Yes, really.
There are certain accounts that just don't matter. Until the "5-minutes-valid" mail provider existed, I did the same with gmx mail addresses. Create, use, never bother to use it again. Since with more and more services there is no sensible way to "disable" or "close" accounts, well, one more corpse floating in their sea of dead accounts.
For example, I sometimes want to read something on Facebook and they insist that it's only visible to people who hand them their information. And, well, creating a throwaway account for Ivana Beritsh is faster than finding one that already has 12345 as its password...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
What is Forrest Gump's password?
1forrest1
P@ssw0rd! did not make the list and half the places I have worked have used that as the password because it meets the windows complexity rules.
Since a site with proper hashing, where in theory the actual passwords are unknowable, wouldn't be on the list. And presumably sites with proper security on the back end would have stronger password complexity requirements in the first place, and vice versa. The blame falls more on the bar than the drunkards it serves.
.
Prisencolinensinainciusol. Ol Rait!
Admin - What is your password?
Chip - Er, is the letter a
Admin - just the letter a?
Chip - like Apple
https://www.youtube.com/watch?...
Like most people in this forum, I have dozens of different passwords to access dozens of different sites. Some of those passwords I choose and protect carefully - those would be the ones that grant me access to my bank account, credit card accounts, etc. Most of the others, I couldn't care less about - I have a Facebook account exclusively so that I can easily post comments on many forums. The account itself, which I created with bogus data, can be hacked to death, for all I care.
I love the threads where we all jerk each other off about how smart we are. Next time we should skip the thread, meet up somewhere and jerk each other off for real!
18 shadow (Unchanged)
Please, please don't tell me that this word's popularity is an ill-conceived response to /etc/shadow. I may have to weep for humanity.
Thanks for sharing my password with the world. As if I needed that.
Why isn't everything requiring at least 8 characters now?
(Also at least 1 letter as well).
Geez, Babs, look at you all submitting and stuff.
That's several stories in the last few days.
Just don't go all Bassett Houndleton on us and start posting long, tedious opinion pieces.
Lost at C:>. Found at C.
I still find it hilarious that people in movies and TV still guess peoples' passwords based on things they know about the person. You'd think they'd start with 123456 and password.
It's far more important to have a different password on each site.. or at least a different password on each site you care about. For some sites is really doesn't matter if it gets hacked or not. The Gawker breach a few years back for example.. who would really give a stuff about having their Gawker password compromised.
So, it doesn't really matter on a lot of these sites if your password is 123456 because everything of value is protected by something better. Isn't it?
Never email donotemail@WeAreSpammers.com
Evolution of Passwords:
1978:
password
1983: Rule: Don't use 'password', too common.
passgas
1990: Rule: Must contain at least one digit
passgas7
1995: Rule: Must contain mixed case
Passgas7
1999: Rule: Must contain at least one punctuation character
Passgas7&
2004: Rule: Must change every 2 months
Passgas7& ... Passgas8* ... Passgas9( ... Passgas1! ...
2009: Rule: Don't use same punctuation as digit key
Passgas7$ ... Passgas8$ ... Passgas9$ ...
2012: Rule: Don't use incremental digit patterns
Passgas71$ ... Passgas17$ ... Passgas$71 ... Passgas$17 ...
2015: Rule: Must be at least 20 characters long
Passgas711111111111$ ... Passgas177777777777$ ...
2017: Rule: Can't use any patterns guessable by AI
Oh f$ck it, just hack me already, dammit @666
Table-ized A.I.
Most important password institution including banks , have strong password policy which would reject "123456", and "password" (heck bank even have a second factor where you use the bank card decoder device but I have no idea on how secure it is). Those password are most probably email or forums password. And as secure as i want to be, I do the same. Email not linked to a bank account and used for spam registration or whatnot => weak password like "jodie123" like my slashdot password. Bank account and email linked to it get something more like "bY7&!-;+#ASumn)(". Yeah sure you might find my jodie123 password leaked. So what ?
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
This sounds bogus to me, everything from windows to most forums, ISP's and Telco's that I am aware of won't let you use such simple passwords. The only place I know that I could use 123456 or password for me is on one of my work smart cards (I have 3 but only one is so weak on security).
IT make us change them, so mine is now 123457, which isn't on the list!
"National Security is the chief cause of national insecurity." - Celine's First Law
'batman' is ideal for a stupid persons password. It has 6 letters, which is often a minimum requirement. It sounds cool. And it reeks of secretivity almost as much as 'password' does.
Feh - I use brucewayne... So nobody will think to know it's batman!
I like how the linked story on password protection can't seem to secure their comment board enough to prevent bots from spamming "$100/hr from home ads" and "look at my blog" posts.
> 2) There are no data in the article regarding how frequently these passwords are used.
There are 448,232 passwords in my corpus right now. The top ones today are:
password frequency
| bobb17 | 5 |
| iceman69 | 5 |
| demon133 | 5 |
| robert8 | 5 |
| saintt9 | 5 |
| alpha123 | 5 |
| jordan | 3 |
| pass | 3 |
| 1234 | 3 |
When I sign up for a website I have a pattern where I take certain letters from the web sites name and add certain amount of numbers to that. Its easy to remember for me and slim chance of someone finding my combo and its a different password for every site I sing up for.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Clearly a lot of teenage boys' passwords were leaked as well.
The same combination as my luggage.
> or at least a different password on each site you care about. For some sites is really doesn't matter if it gets hacked or not. The Gawker breach a few years back for example.. who would really give a stuff about having their Gawker password compromised.
Yeah, it's a very good idea to have your bank password be different from your reddit password. Also, most places let you reset your password by using your email address, so the email password is something of a "master key", it should be good.
A good password isn't a pass word, it's a pass phrase. Length matters above all else.
> Attackers can use precomputed tables made up of all sorts of phrases, letters, numbers etc
> which will get a handle on even very secure passwords.
An eight-character password will be found using a rainbow table, if the service didn't salt their passwords. A twelve-character password won't be cracked. (Assuming the site didn't use DES, thereby truncating it to eight characters).
A rainbow table for 8-character passwords is about a terabyte.
9 character, about 64 TB.
10 character, about 4096 TB.
11 character about 262,144 TB
12 character, about 16,777,216 TB
So for the 12-character table, the bad guy will need MILLIONS of hard drives to store the rainbow table.
With all the "batman" flying around, why didn't anyone check for the obvious???
Bat-Password
I see "correcthorsebatterystaple" isn't in there, I'm surprised.
http://xkcd.com/936/
654321
Now that's secure!
-- Tigger warning: This post may contain tiggers! --
But no Marvel characters?
I've looked everywhere on my keyboard and I can't find anything about using any Marvel character set. Is this some sort of unicode thingee?
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
The article is a little light and fluffy. Doesn't say how these passwords were leaked.
Seems likely, though, that the very fact that they were leaked at all might be a form of selection bias. For example if the leakage vector involved some sort of cracking, it is hardly surprising at all that simple passwords dominate the list.
Every time /. publishes some article about passwords, they seem to list mine. I wish /. would value security of their users more and stop doing this.
On my home laptop, which has no users other than myself, I have a few login accounts for different purposes. One of them is for things like my banking, paying bills, purchases, et al, and that account has a proper password. For all the others, I either have the password as {ENTER}, or I just use the login name as password (if it's an administrator's account that requires a password). Nobody but me will ever get into this computer, so why make it needlessly complicated?
Given cats and porn run the internet, the porn site perspective is a valid one.
I will not repeat the list here, but needless to say, my "pass phrase" is a string of vile profanity, from the darkest subconcious of my perverse mind.
As it happens, It would appear to be fairly common password according to an equivilant article published by a porn industry article a couple years back.
Some of them are idiots, others of them don't think password security is important for all of their accounts. "password" is perfectly adequate for a typical online newspaper comments section password (because worst case is somebody starts writing crank letters to the editor from the fake name you used, with the email that points to a disposable Yahoo email address.) On the other hand, while my Slashdot account isn't particularly valuable, I do have a stronger password on that, especially useful for discussions like this.
Ok, not any more, but for many years the root/admin/whatever password on Stallman's MIT machines was just carriage return. The point was extreme openness, so that anybody could log on, see anything, fix anything, copy any code.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I've had a number of devices over the years where the default password was the MAC address of the admin port or first wired Ethernet port or equivalent, and was also printed on a label on the device. It's not perfect, but it's at least unique, and is strong enough that in most cases, people won't try to crack it, or anybody who might try cracking it has physical access to the box (in which case you're toast anyway.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Even most sites like that will let you use a trivial password as long as you meet rules for length and character set. (In the rare cases that my browser doesn't remember them for me, I occasionally have to try Passw0rd! or passw0rd instead of password if the first guess doesn't work.)
My medium-security passwords were usually L33tSp34k versions of one or two dictionary words, plus whatever capitalization and punctuation were required. But now that I'm occasionally accessing the web through tablets and accessing work systems over cellphone, I've had to switch to Android-friendly passwords, so the letters get grouped together, followed by the numbers, and usually any punctuation is the limited set that appear on the same keypads as the letters or the numbers. So it's Abc,1234 instead of Passw0rd! for trivial passwords now...
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
"...and change the combination on my luggage!!"
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Why is anyone expecting this to change? It's fairly obvious that overwhelming majority of people with these passwords have little to no contact with people who can tell them why it's wrong. It's also fairly obvious that they're not very interested in the issue either.
So why expect change?
I wonder if anyone uses Pi or Pi/2 as there password. Too bad it would take so long to enter it into the password field. Tim S.
I think the headline should read:
The Most Popular *LEAKED* Passwords Are Still "123456" and "password"
Which if you think about it...makes perfect sense why they were vulnerable in the first place.
But my fucking bank allows only letters (caps or lowercase) and numbers. No punctuation or symbols are allowed. And they limit me to 10 characters! Some security, huh?
I ought to change my bank password to something like "yourbanksucks", but that's too many letters.
..I got sick of my wife and friends email accounts getting hacked (both twice within months) due to them using simple passwords and using them on multiple sites so I made these...
http://russtopialabs.bigcartel.com/product/ringminder-tm-mkii-password-crypto-rings
Basically a mnemonic device to help them generate unique per-site passwords (for Luddites who don't like using pass wallet apps).
Marvel fans are not smart enough to spell the name of marvel characters right.
To whom it may concern,
By means of this communication, your website and related websites (named as, but not limited to, the names 'it.Slashdot.org', 'www.Slashdot.org', 'Slashdot.org', and various uppercase and lowercase letter combinations of these names) stands hereby notified of Digital Millenium Copyright Act violation of copyrighted text (named as, but not limited to, the terms "password", "password123", and uppercase versions of both terms), used for various important computer security and related purposes by the undersigned entity.
Please stop using these terms.
Signed,
A Tourney
On behalf of,
A Coward
We have to change our passwords every month and this always causes me to pause a beat to recall the current password. I asssume because one month isn't long enough to forget the last and become habituated to the new. Anyway, I've started using swearwords and, interestinglym find I can recall them significantly faster with less interference from previous passwords.
Now that's easy to remember!
Spaceballs is old, now it's IT crowd, and it makes for way better passwords.
Atari rules... ermm... ruled.
One of my systems at work kept rejecting my attempts to change my password. The one it finally accepted had the added bonus that I wasn't likely to give it out in mixed company.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
It is now...