Most common passwords list from 3 databases

http://blog.jimmyr.com/Password_analysis_of_databases_that_were_hacked_28_2009.php

by Anon84 • 17 years ago

58 40 17 years ago

blog.jimmyr.com

jrockway3• 17 years ago

The passwords say a lot about each site's userbase.

singles.org users commonly use passwords with religious meaning, like "jesus", "pastor", and so on. Apparently this is a site that appeals to the religious folks.

phpBB has things like "phpbb" and "password". Their forums force people to create an account they don't want, so they pick a dumb password. (I had to ask a phpbb question once. I think I used 1234 as my password.)

Finally, Myspace is Myspace, and has commonly-ocuring gems like "poop" and "nigger1". Ah, high school kids...

tlrobinson3• 17 years ago

"On Feb 21 2009 it was discovered that singles.org, a christian dating network, did not have any security at all."

Some of the other ones are puzzling. "trustno1" is from the X-Files, but does anyone know where "letmein" came from?

whatusername• 17 years ago

let-me-in

sketerpot• 17 years ago

I just use the same username and password for all sites I don't care about that much. That way if I ever come back again I can just log in easily, and the process of signing up is so familiar I could do it in my sleep.

No, the real issue is password questions. "What is your mother's maiden name?" "In what city were you born?. Those always seem like a security hole, so I choose a random question and just remember that the answer to all my security questions is "the landed gentry". That's fairly secure, right?

tlrobinson3• 17 years ago

I hope that's not actually the answer you use...

jrockway3• 17 years ago

Yeah, I especially like the sites that ask you to make your own security question. Mine is always, "what is your password?"

dandelany• 17 years ago

Oh, those silly pious folks and their predictable passwords. Jesus may save, but he certainly doesn't protect very well.

jrockway3• 17 years ago

Yeah, thanks to those bad passwords I can totally compromised 100s of accounts! Then I will... uh... oh wait, there is no value in doing that.

The best protection is not a good password. It's having something that's not worth stealing.

mroman• 17 years ago

You gotta be kidding . . .

geuis• 17 years ago

Might be an interesting white-hat idea to have a service that gets into a social network and spiders out, collecting thousands of user names. Then attempt library login attempts. In the event they are successful, the service contacts the user and warns them that they have a weak password.

Unfortunately this is so similar to standard phishing attacks that I'm afraid the good would be offset by the bad of reinforcing user behaviors that its ok to click through on 3rd party notices like this.

DenisM• 17 years ago

This is also likely illegal (as in: jail-time illegal). Talk to a lawyer before implementing anything like this.

snprbob86• 17 years ago

Why aren't these sites storing salted hashes? Plain text passwords are bad news...

dreish2• 17 years ago

Where did you get that impression? Not from the linked-to article, from my reading of it.

hbien2• 17 years ago

If a site is storing hashed passwords with salts, you generally don't know what the user's password is and you can't unhash them to find out.

timdorr• 17 years ago

Good thing that...heh...my password is totally...um...not on that list.....

catz• 17 years ago

Yup, I'm also lucky that poiuyt is not on that list.

algebra• 17 years ago

'volcom1'? (#39 on myspace)

interesting.

mynameishere• 17 years ago

It's better to use 123456 at unimportant sites than re-using your e-trade password. Simple good sense.

eli2• 17 years ago

what the heck is "rotimi" ?

willchang• 17 years ago

Rotimi is a Nigerian given name. Perhaps it reflects a large number of Nigerian scammers?

eli2• 17 years ago

I dunno, seems weird. 163k hits on google? Doesn't even seem like a particularly common Nigerian name. And there aren't many other given names on the list.

GeneralMaximus• 17 years ago

I have recently started generating all my passwords using a Markov chain script I wrote in Python. They're much more secure and, since they sound very similar to English words, easier to remember than, say, &&364e7forty-two88()l.

quizbiz2• 17 years ago

I started writing words backwards (among other things). Not as secure but I don't hit myself when cookies expire.

dkokelley3• 17 years ago

I've been a fan of geometric shapes on the keyboard and number pad.

quizbiz2• 17 years ago

Until I read this, I always wondered why the keyboard was called QWERTY. As soon as I saw it on the list, I instantly realized the reason. I feel ignorant.

schtono• 17 years ago

Having a closer look at the list shows that password rules like "alpha + numericals" don't add much of security in real world scenarios: In approx 95% people seem to add one or two digits at the end of a string.

icefox• 17 years ago

Clearly the way to go is the append the number '3' to your password ;)

dkokelley3• 17 years ago

I don't like password requirements - It restricts the number of possibilities and for crackers who know the restrictions it makes life a lot easier for them.

Tichy• 17 years ago

I like how some people go the extra length, using "12345678" instead of "123456".

streety• 17 years ago

Out of interest does anyone attempt to warn their users when they attempt to use a common/easily guessed password?

At the moment all I do is insist on a minimum length but it doesn't seem as though it would be all that difficult to add checks for common passwords.

tvchurch• 17 years ago

"Don't forget God. System operators love to use God. It's that whole male ego thing."

djahng• 17 years ago

Haha Hackers...and when you break into a computer system it goes all 3-D too right?

dkokelley3• 17 years ago

Or for stricter passwords: IamGod (6 characters), IamG0d (characters and numbers), or 1@m&0D (Probably not the best attempt, but you get my point).

Most common passwords list from 3 databases

Related Stories