Slashdot Mirror
The Most Popular Bad Passwords of 2015 (dice.com)
Nerval's Lobster writes: For years, security experts have told people they need better passwords protecting their online accounts: no more '123456' or 'qwerty' or 'password.' Based on SplashData's fifth annual list of the 25 most common passwords, however, it's clear that relatively few people are listening to that advice. The firm based its list on more than 2 million leaked passwords during the year. The most popular, as in 2014, was '123456,' followed by 'password' and the ingenious, uncrackable '12345678.' One new entry on this ignoble list: 'starwars' in 25th place, no doubt thanks in part to the popularity of 'The Force Awakens' and the accompanying marketing campaign. Seems like a lot of people have forgotten (or never learned) that, while it's a pain to create (much less remember) a complicated password with lots of numbers and special characters, it's nothing compared to the pain of having your online accounts compromised. Maybe, as some have proposed, we could someday kill passwords for most services.
This.
Telling me "password" is a bad password isn't news. It's obvious. And you know what? For accounts I don't care about, it's a perfectly good password.
You want me to create an account to leave a comment on your stupid little blog? I don't see what's wrong with password.
Hell, a lot of forums are like that too - want to get this download? Register for an account! So yes, I'm going to use password, because chances are, I won't ever visit it again.
Now, my Amazon, Paypal, banking and other passwords? You can bet they aren't on that list!
And guess what? There's a ton of sites that need registration, so no wonder they stay on the top - for these worthless accounts, people will use worthless passwords. If your password database has a lot of these passwords, perhaps you might want to rethink your account strategy. Maybe your visitors don't see your accounts system as valuable as you do.
That isn't for your security, it's so they can obtain your phone number. It really is just a nasty and insidious way of forcing users to divulge personal information.