Slashdot Mirror
The Most Popular Passwords Are Still "123456" and "password"
BarbaraHudson writes: The Independent lists the most popular passwords for 2014, and once again, "123456" tops the list, followed by "password" and "12345" at #3 (lots of Spaceballs fans out there?) . "qwerty" still makes the list, but there are some new entries in the top 25, including "superman", "batman", and "696969". The passwords used were mostly from North American and Western European leaks.
My password is ',.pyf, you insensitive clod!
I thought the most popular password was just {enter}
People like this are rightfully called incompetent. Hopefully they're not multi-billion dollar companies.
mooltipass!
Thing is, 'password' is so common, no one will guess that I'm using it. I'm outfoxing the foxes!
As illustrated by Stanfordâ(TM)s password policy shuns one-size-fits-all security http://arstechnica.com/securit... via https://itservices.stanford.ed...
69 Dude!
hunter2. But I guess that all should appear as '*******' to you as it is encrypted.
That's the same combination I have on my luggage!
At least 123456 has one more digit.
But no Marvel characters?
1) Clearly bad passwords will be the most popular. Some people will blow off security and will pick a bad password.
2) There are no data in the article regarding how frequently these passwords are used.
3) There is no representation of what these passwords are protecting. Maybe these are passwords to something harmless like accounts in some children's game. In which case, who cares?
I'm more worried about bad password storage practices than I am people using bad passwords. Individually, poor passwords are bad because it leaves people vulnerable, but if a company isn't properly hashing their passwords and that list is stolen? It doesn't matter how strong my 12 character long alphanumeric password is, because it's right there for the hackers.
Computer security is not a naturally intuitive domain for most human beings, absent some properly directed training and experience.
It doesn't make them idiots. But it does make them vulnerable.
I've fallen off your lawn, and I can't get up.
On my own computers behind a firewall. I consider use of the password password about the same as having none.
Because the media lost much of it's credibility a long time ago and because they keep fear mongering, people pay less attention to the news. What ends up happening is people don't react until they become a victim or someone close becomes a victim. Everybody thinks it happens to other people.
Marvel readers are obviously more intelligent. ;p :) )
(or the built-in punctuation of the names just lends itself to passwords... spider-man, ant-man, S.H.I.E.L.D
Actually that last one isn't a bad idea...
I got a kick out of this one.
(changing password now)
The article mentions this is based on sites compromised, I wonder if this list isn't to some extent self-selecting towards bad passwords. Lower value sites are more likely to be compromised than high value sites like Amazon or Google, and on low value sites people are much more likely to use garbage. Personally I use a pw database but still use junk passwords on sites when its irrelevant if the account were to be compromised.
Really. Yes, really.
There are certain accounts that just don't matter. Until the "5-minutes-valid" mail provider existed, I did the same with gmx mail addresses. Create, use, never bother to use it again. Since with more and more services there is no sensible way to "disable" or "close" accounts, well, one more corpse floating in their sea of dead accounts.
For example, I sometimes want to read something on Facebook and they insist that it's only visible to people who hand them their information. And, well, creating a throwaway account for Ivana Beritsh is faster than finding one that already has 12345 as its password...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
What is Forrest Gump's password?
1forrest1
P@ssw0rd! did not make the list and half the places I have worked have used that as the password because it meets the windows complexity rules.
Since a site with proper hashing, where in theory the actual passwords are unknowable, wouldn't be on the list. And presumably sites with proper security on the back end would have stronger password complexity requirements in the first place, and vice versa. The blame falls more on the bar than the drunkards it serves.
.
Prisencolinensinainciusol. Ol Rait!
I love the threads where we all jerk each other off about how smart we are. Next time we should skip the thread, meet up somewhere and jerk each other off for real!
18 shadow (Unchanged)
Please, please don't tell me that this word's popularity is an ill-conceived response to /etc/shadow. I may have to weep for humanity.
Why isn't everything requiring at least 8 characters now?
(Also at least 1 letter as well).
Geez, Babs, look at you all submitting and stuff.
That's several stories in the last few days.
Just don't go all Bassett Houndleton on us and start posting long, tedious opinion pieces.
Lost at C:>. Found at C.
It's far more important to have a different password on each site.. or at least a different password on each site you care about. For some sites is really doesn't matter if it gets hacked or not. The Gawker breach a few years back for example.. who would really give a stuff about having their Gawker password compromised.
So, it doesn't really matter on a lot of these sites if your password is 123456 because everything of value is protected by something better. Isn't it?
Never email donotemail@WeAreSpammers.com
Evolution of Passwords:
1978:
password
1983: Rule: Don't use 'password', too common.
passgas
1990: Rule: Must contain at least one digit
passgas7
1995: Rule: Must contain mixed case
Passgas7
1999: Rule: Must contain at least one punctuation character
Passgas7&
2004: Rule: Must change every 2 months
Passgas7& ... Passgas8* ... Passgas9( ... Passgas1! ...
2009: Rule: Don't use same punctuation as digit key
Passgas7$ ... Passgas8$ ... Passgas9$ ...
2012: Rule: Don't use incremental digit patterns
Passgas71$ ... Passgas17$ ... Passgas$71 ... Passgas$17 ...
2015: Rule: Must be at least 20 characters long
Passgas711111111111$ ... Passgas177777777777$ ...
2017: Rule: Can't use any patterns guessable by AI
Oh f$ck it, just hack me already, dammit @666
Table-ized A.I.
Most important password institution including banks , have strong password policy which would reject "123456", and "password" (heck bank even have a second factor where you use the bank card decoder device but I have no idea on how secure it is). Those password are most probably email or forums password. And as secure as i want to be, I do the same. Email not linked to a bank account and used for spam registration or whatnot => weak password like "jodie123" like my slashdot password. Bank account and email linked to it get something more like "bY7&!-;+#ASumn)(". Yeah sure you might find my jodie123 password leaked. So what ?
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
This sounds bogus to me, everything from windows to most forums, ISP's and Telco's that I am aware of won't let you use such simple passwords. The only place I know that I could use 123456 or password for me is on one of my work smart cards (I have 3 but only one is so weak on security).
IT make us change them, so mine is now 123457, which isn't on the list!
"National Security is the chief cause of national insecurity." - Celine's First Law
Feh - I use brucewayne... So nobody will think to know it's batman!
> 2) There are no data in the article regarding how frequently these passwords are used.
There are 448,232 passwords in my corpus right now. The top ones today are:
password frequency
| bobb17 | 5 |
| iceman69 | 5 |
| demon133 | 5 |
| robert8 | 5 |
| saintt9 | 5 |
| alpha123 | 5 |
| jordan | 3 |
| pass | 3 |
| 1234 | 3 |
When I sign up for a website I have a pattern where I take certain letters from the web sites name and add certain amount of numbers to that. Its easy to remember for me and slim chance of someone finding my combo and its a different password for every site I sing up for.
by TheSpoom (715771) Uncaring Linux user here. I have nothing to add to this but please continue. *munches popcorn*
Clearly a lot of teenage boys' passwords were leaked as well.
> or at least a different password on each site you care about. For some sites is really doesn't matter if it gets hacked or not. The Gawker breach a few years back for example.. who would really give a stuff about having their Gawker password compromised.
Yeah, it's a very good idea to have your bank password be different from your reddit password. Also, most places let you reset your password by using your email address, so the email password is something of a "master key", it should be good.
A good password isn't a pass word, it's a pass phrase. Length matters above all else.
> Attackers can use precomputed tables made up of all sorts of phrases, letters, numbers etc
> which will get a handle on even very secure passwords.
An eight-character password will be found using a rainbow table, if the service didn't salt their passwords. A twelve-character password won't be cracked. (Assuming the site didn't use DES, thereby truncating it to eight characters).
A rainbow table for 8-character passwords is about a terabyte.
9 character, about 64 TB.
10 character, about 4096 TB.
11 character about 262,144 TB
12 character, about 16,777,216 TB
So for the 12-character table, the bad guy will need MILLIONS of hard drives to store the rainbow table.
I see "correcthorsebatterystaple" isn't in there, I'm surprised.
http://xkcd.com/936/
I can think of a few ways that people leak their own passwords. Emails to a co-worker when you're sick or away, chat or IM logs, picking an easy password so that if they forget it they can just try a few easy ones at random, being in a rush to change it because "here is your temporary password. You may only use it to change your password, after which you can use your new account" (a security practice that in practice causes the human elephant to fail).
While storing passwords as a hash offers some defense, even that doesn't work for common passwords where the hash value is known - just look at the stored hash and use the corresponding password. And then their's rainbow tables ... get access to the server involved and you can quickly match a password for every account.
And none of this includes the "password on a post-it under the keyboard." Go through any office and you'll find at least one (if the post-it isn't just stuck to the corner of the screen).
I'm sure in 5 minutes you can think of more ways to leak passwords :-)
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
654321
Now that's secure!
-- Tigger warning: This post may contain tiggers! --
But no Marvel characters?
I've looked everywhere on my keyboard and I can't find anything about using any Marvel character set. Is this some sort of unicode thingee?
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
The article is a little light and fluffy. Doesn't say how these passwords were leaked.
Seems likely, though, that the very fact that they were leaked at all might be a form of selection bias. For example if the leakage vector involved some sort of cracking, it is hardly surprising at all that simple passwords dominate the list.
On my home laptop, which has no users other than myself, I have a few login accounts for different purposes. One of them is for things like my banking, paying bills, purchases, et al, and that account has a proper password. For all the others, I either have the password as {ENTER}, or I just use the login name as password (if it's an administrator's account that requires a password). Nobody but me will ever get into this computer, so why make it needlessly complicated?
Ok, not any more, but for many years the root/admin/whatever password on Stallman's MIT machines was just carriage return. The point was extreme openness, so that anybody could log on, see anything, fix anything, copy any code.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
I've had a number of devices over the years where the default password was the MAC address of the admin port or first wired Ethernet port or equivalent, and was also printed on a label on the device. It's not perfect, but it's at least unique, and is strong enough that in most cases, people won't try to crack it, or anybody who might try cracking it has physical access to the box (in which case you're toast anyway.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
My medium-security passwords were usually L33tSp34k versions of one or two dictionary words, plus whatever capitalization and punctuation were required. But now that I'm occasionally accessing the web through tablets and accessing work systems over cellphone, I've had to switch to Android-friendly passwords, so the letters get grouped together, followed by the numbers, and usually any punctuation is the limited set that appear on the same keypads as the letters or the numbers. So it's Abc,1234 instead of Passw0rd! for trivial passwords now...
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Headupassians don't typically care about those things...
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
"...and change the combination on my luggage!!"
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Why is anyone expecting this to change? It's fairly obvious that overwhelming majority of people with these passwords have little to no contact with people who can tell them why it's wrong. It's also fairly obvious that they're not very interested in the issue either.
So why expect change?
IMHO, unimportant Sites should not ask visitors to create a password at all !
Why don't they just ask an OpenId or a {facebook|google|msn|yahoo|whatever} account and use its authentication protocol ?
Why do I have to create a password to post a comment on /. ?
I wonder if anyone uses Pi or Pi/2 as there password. Too bad it would take so long to enter it into the password field. Tim S.
Often the word "to" is too short.
I did like the episode of Dexter where he had to guess his foul-mouthed sister's password. "password". Nope. "fuckingpassword". I'm in.
Have gnu, will travel.
We have to change our passwords every month and this always causes me to pause a beat to recall the current password. I asssume because one month isn't long enough to forget the last and become habituated to the new. Anyway, I've started using swearwords and, interestinglym find I can recall them significantly faster with less interference from previous passwords.
Now that's easy to remember!
Spaceballs is old, now it's IT crowd, and it makes for way better passwords.
Atari rules... ermm... ruled.
One of my systems at work kept rejecting my attempts to change my password. The one it finally accepted had the added bonus that I wasn't likely to give it out in mixed company.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.