SplashData has announced its annual list of the 25 most common passwords found on the Internet – thus making them the “Worst Passwords” that will expose anybody to being hacked or having their identities stolen. In its fourth annual report, compiled from more than 3.3 million leaked passwords during the year, “123456”and “password” continue to hold the top two spots that they have held each year since the first list in 2011. Other passwords in the top 10 include “qwerty,” “dragon,” and “football.”
Sweet Jesus, you deserve to be hacked.
I am sure only the most senior executes that have access to the most sensitive data have passwords in the top 10.
that is why I use 654321
I get your exasperation but to say someone deserves to be hacked is not cool in my book – no one deserves it. Kind of like saying she deserved to be raped for wearing something so revealing.
My password is all zeros. But how many?!? HOW MANY?
Yeah. If we were just a little more organized, we’d have a better solution already. (Some examples: Better password verification, telling the user their password rather than letting them pick one, or password managers built in for the last decade.)
A contributing factor is the difficulty of creating truly secure passwords. Many sites don’t allow spaces. So you can’t write sentences such as “correct horse battery staple” ( http://xkcd.com/936/ ) or something equally easy to remember and hard to guess. The benefit being you don’t have to remember case or nonsense phrases, which are forced on you as security theater, rather than real security.
One!
CorrectHorseBatteryStaple
You don’t need spaces to use Randall’s suggestion.
Anyway, passwords, as a security mechanism, are broken. Passwords will never be “truly secure”. Two-factor authentication, biometrics, etc. is the way to go. Of course, the only way to “truly secure” any information or device is to render it completely inaccessible by anyone.
Damnit. Jerk.
goes to change password
Even 44 bits of entropy is not great. I can get 150 without really blinking using 1Password. The way we use passwords is broken, but using something like 1Password you can do something worthwhile with the existing system.
The really awkward part of passwords is trying to get something easy to remember for every site.
People don’t tolerate completely secure, for the most part.
Even two-factor auth is so intensely annoying I only use it for AppleID and Google.
No. Nobody will tolerate “completely secure” since it is quite unusable. This is what it comes down to. Your information is only as secure as the inconvenience you are willing to tolerate.
Personally, I think calling two-factor authentication “intensely annoying” is a but much. Fortunately, Google only asks for a code once every 30 days, once I’ve logged on using a particular machine. New machine, new challenge. I have to provide a code every time I pay (PayPal) for an eBay auction. It’s a minor annoyance, at best, and something I’m willing to put up with to make my account more secure.
Avoiding security methods because you see them as “intensely annoying” automatically makes YOU more vulnerable, and it’s totally your choice. It’s not a short-coming of the technology.