75% Use Same Password For Social Media & Email 278
wiredmikey writes "Over 250,000 user names, email addresses, and passwords used for social networking sites can easily be found online. A study of the data collected showed that 75 percent of social networking username and password samples collected online were identical to those used for email accounts. The password data was gathered from blogs, torrents, online collaboration services and other sources. It was found that 43 percent of the data was leaked from online collaboration tools while 21 percent of data was leaked from blog postings. Meanwhile, torrents and users of other social hubs were responsible for leaking 10 percent and 18 percent of user data respectively...."
Passwords (Score:5, Insightful)
As long as passwords remain the central method of authentication, this will continue.
Same password (Score:3, Insightful)
I'd use the same password for everything if they all had the same basic requirements.
Re:Use Password Hasher (Score:5, Insightful)
And if you ever need to sign in from a computer that doesn't have firefox, and that extension, installed.....you are stuck.
Problem is lack of importance (Score:3, Insightful)
I don't care that I don't have all that much concern for facebook's password. If someone takes my account, it would be unfortunate, but is it really the end of the world?
Places where it might cause me economic misfortunate, well, those I care about, but everyone out there thinks that their site is so important for passwords.
Some places, it's important. Others, not so much.
Paranoia (Score:2, Insightful)
I've lived this blasphemous insecure lifestyle on the internet for decades now, and have never once had an account compromised. Whether this is because I'm a worthless peon or because password security is bullshit is yet to be determined.
Moral of the story: be insignificant to the point that you're considered below the bad guys. Failing that, stop fucking worrying.
Re:"Leaked"? (Score:3, Insightful)
I have often wondered that... (Score:3, Insightful)
The danger of too many password requirements (Score:5, Insightful)
- at least two uppercase letters
- at least two lowercase letters
- at least two numbers
- at least two symbols
- at least 12 characters
- no characters that repeat
- nothing that's in your personal records
- nothing from the dictionary that's over three characters
- nothing from a FOREIGN dictionary that's over three characters
- at least three characters different from your last 10 passwords
No joke, I used a system for years that had those exact password requirements. Worse yet, I had to SUPPORT this system. Sometimes it would take a half hour for me to help someone figure out a new password.
There is a danger in creating a password system with two many requirements, because I know very few people who used that system who didn't have their password on a sticky note on their monitor.
Re:Passwords (Score:5, Insightful)
My password is IAMGAY. That way, even if it got found out I can be confident no one will want to use it, because that would mean they are gay.
What if they are gay? ;)
Your comment reminds me of the best password policy I've ever heard: offensive gibberish. If someone's password is suitably embarrassing odds are quite good that they won't share it with anyone.
Re:Use Password Hasher (Score:4, Insightful)
In Tinfoil Hat Land, if you don't have FF installed, then it's likely not a computer you control*, and if it's a computer you don't control, then should you really be entering your password**?
* It must be a machine at work, friend or family member's house, public terminal like a coffee shop, public library, etc.
** If it's not your computer, you don't know who that computer has "been with". There could be key-loggers, cookie-trackers, syphilis. Who knows!?
Re:"Leaked"? (Score:5, Insightful)
It's pretty amazing just how much of the world is based on trust isn't it?
And it's equally tragic that it can't.
I don't think it's so much that people automatically trust each other, although that's certainly the case sometimes, it's more like it never occurs to too many people, unfortunately, that what they divulge could cause problems in the wrong hands.
For many years now, when someone asks me for information, my first thought is not to give the information, but to consider why I don't want to give it to that person. And I don't consider myself particularly paranoid with respect to what I share.
It gets tiring after awhile. Modern life in the 21st century requires a level of vigilance regarding information that probably never existed outside of the military, national security apparatus, law enforcement or some elements of business before a couple decades ago.
"Loose lips sink ships" was a common saying during World War II, but nowadays everyone must practice that level of vigilance over their own information all the time merely to be safe from criminals.
Re:Problem is lack of importance (Score:5, Insightful)
Re:The danger of too many password requirements (Score:2, Insightful)
Aa1!Bb2@Cc3#
Next passwords:
a1!Bb2@Cc3#A
1!Bb2@Cc3#Aa
!Bb2@Cc3#Aa1
etc.
Or
Bb2@Cc3#Dd4$
Cc3#Dd4$Ee5%
Dd4$Ee5%Ff6^
etc.
Re:Passwords (Score:4, Insightful)
Re:"Leaked"? (Score:2, Insightful)
It's pretty amazing just how much of the world is based on trust isn't it?
Especially since, at least in the US, we seem to have been making crime stories the prime entertainment for decades, and there's a lot of money made from fear mongering.
Re:"Leaked"? (Score:3, Insightful)
Btw I have to agree with one of the posts above, having your password be very offensive usually prevents you from sharing it at all. I do have such a password somewhere, and was horrified when a friend of mine cracked it.
firefox has that hash function (Score:3, Insightful)
but there's no reason why you can't have your own hash function in your head
take a root password, say "penguin"
say you are creating a password for slashdot
so your password for slashdot is "penguinslashdot"
but for gmail its "penguingmail"
this is an extremely simplistic algorithm. i'm just using it as an example to show you: remember a PASSWORD GENERATING ALGORITHM, not a password. then you have a unique password for every site, but you don't have to remember 500 different passwords
a REAL algorithm could be something like "the first letter of my root password plus the third letter of the website name's ascii character value plus 3 divided by my home phone number as a kid plus the second letter of my root password plus... etc"
or whatever
the actual password used for each site can be quite variable and the algorithm can still be hard to guess even with a hacker who knows three or four such passwords
the point is: you don't need to remember a password, you need to remember a password creating ALGORITHM, in your head, that only you know, which is infinitely more secure, but no harder to remember
Re:Yup, Probably true (Score:4, Insightful)
Same basic process, though different criteria for me:
Like the parent, it's really a matter of compartmentalization and damage control. If you don't own the system, it's not completely trustworthy. If it's your system, it's only modestly trustworthy. If you're doing something criminal/embarassing/stupid, it's better to leave all notes at the bottom of the Marianas trench.
Re:"Leaked"? (Score:4, Insightful)
That sounds like an argument for why porn should NOT be put on bluray and in HD!
Re:The danger of too many password requirements (Score:2, Insightful)
Yes, that was sort of the whole point. The stricter you make the password requirements the more likely people are to find a completely insecure way to defeat them.
Re:Same password (Score:5, Insightful)
I use a set of passwords for varying levels of trust.
Highly secure passwords (usually site specific and follow good password rules) for banking, email, computer accounts, etc.
Medium secure passwords (usually follow good password rules but passwords may be used for more than one site) for trusted shopping sites (i.e. Amazon, etc.)
Medium-Low secure passwords (may not follow good password rules but still reasonably secure against dictionary attacks) for social media and for one-off shopping sites.
Low secure passwords (probably only stops low-motivated hackers, passwords re-used at multiple sites) for throw-away registrations and communities that have very little tie to my personal information
It's really more for convenience than security, but in areas where I need the security, I'll put up with the hassle.
Its about convenience (Score:2, Insightful)
Many people are going on about how they use a password manager or a hasher or some such which supposedly solves this problem of remebering passwords, but all they've really done is substitute one inconvenience for another. The reason people use one password everywhere is *convenience*. They do not want to remember a bunch of different passwords, or worse, forget them! Sure a password manager prevents that when you are at your computer, but now it's almost impossible to login unless you have your computer in front of you, which could be extremely inconvenient under certain circumstances, for example if you need to access an email while visiting family for dinner and didn't bring your laptop, or if you lose your computer.
People who use one password for everything are not going to stop unless a more convenient option arises, which is unlikely to occur. I guess the people who steal passwords will always have a job!
Re:"Leaked"? (Score:2, Insightful)
I suspect it has more to to with the progression of concepts.
Weapons: I had a rock, then I had a sling, then I had a bow-and-arrow, now I have a gun. I'm still hitting a target with a projectile. I take an action, something moves in roughly direction I tell it to, person or thing on other side hopefully develops a hole or wound where I intended. The method of projection and controls have changed, but the concept is the same (ready, aim, fire, yay! hit, shit! miss, target dead, target wounded, target VERY PISSED OFF).
Transportation: I had feet, then I had shoes, then I had a horse, then I had a bicycle, then I had a car. Again, still moving about, going 2 kilometers and turning left just takes less time but is the same concept. I take an action, something moves in roughly direction I tell it to, I hopefully get where I wanted to go. The controls have changed (legs->reins->handlebar->steering wheel) but the concepts aren't different (go, stop, turn left, turn right, etc).
Computers. I "power up" my "PC" and "monitor" and wait for my "desktop" in "Windows" to appear so I can "drag" a "cursor" then "double-click" on an "icon" on my "monitor" with a "mouse" to "open a window" so I can use a "program" called a "word processor" to write a "document" that is "saved" on a "subfolder" on an "external storage device" called "E:\" so I can "eject" the device before I pull it from my "USB port" on the USB "hub" that is plugged into my "case" and give it to a friend who can't read it because he uses "Office" on a "Mac" and my computer runs "Windows" so I needed to save it using a different "format" but I want to make sure not to "format" the "external storage device" to change the "format" but to "reopen" it and save it with a different "extension" and "file type".
That sentence made perfect sense, right? Of course it did. To you. But that's a shitload of novel concepts that someone who hasn't spent at least a few months in front of a computer to absorb in one sitting, yes? And that's all to write one document and save it. Nothing complex at all.
Few of these concepts have a pre-computer meaning, and when they do the analogies are distant and vague. The keyboard is analogous to a typewriter, but lacks the immediacy of space or the tactile "I push a letter, hear a bang, letter is on the paper in front of me".
It's not only that computers are new, but that they are completely new. We're not going from handwritten paper to books. We're going from immediacy to abstraction, and doing different things, and trying to express what those things are with poor analogies to similar things we've done before.
Look at most humans in a court of law. Look at many people when confronted with an engine that needs to be rebuilt, or even oil that needs to be changed. Watchmaking? Woodworking? Carving? Rolling a Kayak? Aviation? Knitting? Skiing? There are a lot of things that look really complex until you take the time to understand them, then you understand that they ARE really complex but not in the ways you imagined, and that "the bits I thought were complex are simple, but the bits I thought didn't exist are fucking complex" feeling will cause your brain to occasionally slide to "OFF".
It's called "being overwhelmed with too much new information all at once, with no way for Ye Olde Monkey Brain to categorize it into the neat little categories it's been using for the last x years."
In the case of computers, particularly if it's something you have no personal interest in but are told by someone else you need to master it.