Forgot your password?
typodupeerror
Privacy Security Social Networks Your Rights Online

75% Use Same Password For Social Media & Email 278

Posted by CmdrTaco
from the my-password-is-trustno1 dept.
wiredmikey writes "Over 250,000 user names, email addresses, and passwords used for social networking sites can easily be found online. A study of the data collected showed that 75 percent of social networking username and password samples collected online were identical to those used for email accounts. The password data was gathered from blogs, torrents, online collaboration services and other sources. It was found that 43 percent of the data was leaked from online collaboration tools while 21 percent of data was leaked from blog postings. Meanwhile, torrents and users of other social hubs were responsible for leaking 10 percent and 18 percent of user data respectively...."
This discussion has been archived. No new comments can be posted.

75% Use Same Password For Social Media & Email

Comments Filter:
  • Passwords (Score:5, Insightful)

    by geek (5680) on Monday August 16, 2010 @01:20PM (#33265472) Homepage

    As long as passwords remain the central method of authentication, this will continue.

  • "Leaked"? (Score:5, Interesting)

    by Pojut (1027544) on Monday August 16, 2010 @01:21PM (#33265476) Homepage

    So wait...how exactly did they get hold of passwords?

    • Re:"Leaked"? (Score:5, Interesting)

      by KnightBlade (1074408) on Monday August 16, 2010 @01:30PM (#33265590)
      While I was studying Info. Sec. at my univ, my professor at the time told the class about this research they had about passwords. They were going around gathering statistics by asking random people questions about their passwords- length, number of special characters, if they used the same passwords, the number of times they changed them and so on. He said what amazed him was that one in every 5-6 people would just tell them their password and ask is that good enough?
      • Re: (Score:3, Insightful)

        by BergZ (1680594)
        It's pretty amazing just how much of the world is based on trust isn't it?
        • Re:"Leaked"? (Score:5, Insightful)

          by ConceptJunkie (24823) on Monday August 16, 2010 @01:44PM (#33265796) Homepage Journal

          It's pretty amazing just how much of the world is based on trust isn't it?

          And it's equally tragic that it can't.

          I don't think it's so much that people automatically trust each other, although that's certainly the case sometimes, it's more like it never occurs to too many people, unfortunately, that what they divulge could cause problems in the wrong hands.

          For many years now, when someone asks me for information, my first thought is not to give the information, but to consider why I don't want to give it to that person. And I don't consider myself particularly paranoid with respect to what I share.

          It gets tiring after awhile. Modern life in the 21st century requires a level of vigilance regarding information that probably never existed outside of the military, national security apparatus, law enforcement or some elements of business before a couple decades ago.

          "Loose lips sink ships" was a common saying during World War II, but nowadays everyone must practice that level of vigilance over their own information all the time merely to be safe from criminals.

          • Re: (Score:2, Interesting)

            by fishbowl (7759)

            >"Loose lips sink ships" was a common saying during World War II

            And today we know *way* too much, in way too much detail, about the location and movement of troops, their morale, reports of their actions, etc.

          • Re: (Score:3, Insightful)

            I think the whole driving/road system is based on trust and it works quite well. It's potentially a very dangerous environment where the penalties for being reckless are not as bad as the potential damage you can cause. And yet it somehow works.

            Btw I have to agree with one of the posts above, having your password be very offensive usually prevents you from sharing it at all. I do have such a password somewhere, and was horrified when a friend of mine cracked it.
            • by Haffner (1349071)
              Driving requires a license, that has a test associated with it. Also, criminal penalties are very easy to inflict on those who misbehave.
          • Re:"Leaked"? (Score:5, Informative)

            by plover (150551) * on Monday August 16, 2010 @02:02PM (#33266044) Homepage Journal

            It's not so much about trusting a person. Although that's an exploitable component for social engineers, social engineering is fairly rare, and it doesn't scale well. It's really about the machines in which we place that trust, and how those machines can be hacked. That's the easy part to scale up.

            Hackers (specifically criminal types) operate on statistics. They don't care so much "which" websites they break open, they care about breaking into "some" sites and harvesting what can be found there. They also harvest the easy stuff: cleartext passwords, cleartext account numbers, etc. They won't run a deep password cracker on a million accounts, but they might run a simple /usr/dict/words kind of scan.

            Of course once you've broken a thousand passwords on socialsite.com, you can try correlating those to majorbank.com and amazon.com and all the other potential sources of money. Again, you don't care if 900 out of a thousand fail, because you can still effectively steal from the 100 that remain.

        • Re: (Score:2, Insightful)

          by aGuyNamedJoe (317081)

          It's pretty amazing just how much of the world is based on trust isn't it?

          Especially since, at least in the US, we seem to have been making crime stories the prime entertainment for decades, and there's a lot of money made from fear mongering.

      • He said what amazed him was that one in every 5-6 people would just tell them their password and ask is that good enough?

        How many of those were their real passowrds?`

    • Scraping sites, using keywords to locate interesting data presumably. It says right there, "blogs, torrents, online collaboration services and other sources".
      As in, people posted their passwords there and said something like "this is my password", right there in the open. As for verification, my best guess is they got the providers to agree to check the scraped list against their accounts. I don't think they'd try to log in to the accounts to verify them, as they're a reputable company and such an action w
  • Use Password Hasher (Score:5, Informative)

    by mbuimbui (1130065) on Monday August 16, 2010 @01:24PM (#33265510)

    Use firefox extension's password hasher (http://wijjo.com/PasswordHasher). Then you only need to remember one password but can use it for a variety of sites. If any one site's passwords get leaked, you dont have to go around an update your password for all other sites.

    • by Anonymous Coward on Monday August 16, 2010 @01:27PM (#33265552)

      And if you ever need to sign in from a computer that doesn't have firefox, and that extension, installed.....you are stuck.

      • Unless you have [url=http://portableapps.com/apps/internet/firefox_portable]Firefox Portable[/url].
      • by tool462 (677306) on Monday August 16, 2010 @01:42PM (#33265772)

        In Tinfoil Hat Land, if you don't have FF installed, then it's likely not a computer you control*, and if it's a computer you don't control, then should you really be entering your password**?

        * It must be a machine at work, friend or family member's house, public terminal like a coffee shop, public library, etc.
        ** If it's not your computer, you don't know who that computer has "been with". There could be key-loggers, cookie-trackers, syphilis. Who knows!?

        • by BJ_Covert_Action (1499847) on Monday August 16, 2010 @01:51PM (#33265884) Homepage Journal
          So I guess Chrome, Opera, Iron, Seamonkey, and dozens of other web browsers are completely insecure?

          I know IE6 is a nightmare. I don't really pay attention to IE7 or IE8 because I don't use them. I know Chrome involves some privacy issues, and I suppose there is something that has to do with selective script management. From what I hear, however, Opera and Iron are supposed to be pretty damn secure. Also, SeaMonkey is supposed to be pretty decent. I can't talk about Safari because, like IE, I really don't care about it at all.

          Of course, you prefixed your post with "In Tinfoil Hat Land..." so I suppose you were being somewhat sarcastic. But I am curious, do you really think FF is the only secure browser out there?
          • The impression I got is, it's not so much the browser. It's the fact that the user doesn't control the computer. At work, I use IE7, but even if I used FF (or Opera, Iron, Lead, or whatever), I wouldn't do anything regarding important passwords (my /. pw doesn't count) on it.

          • by jvkjvk (102057)

            So I guess Chrome, Opera, Iron, Seamonkey, and dozens of other web browsers are completely insecure?

            Theoretically yes, those programs are totally insecure on any machine you do not own.

            As are any other programs installed on that machine.

            This is simply due to the fact that what you see isn't necessarily what you get. The machine may have any number of programs running that will hide the truth from you, steal your password as you enter it into Iron, Chrome, Opera, Seamonkey, or dozens of other web browsers.

            In fact, how do you even know that you are running Opera, Chrome, or what have you on such a machine?

      • I use a password manager for password storage and generation. Stores them nicely with AES. New password for all important stuff. I also upload it to my online storage, as no-one can do anything with it without the master password (which is also long, and computer generated.. it's fascinating what you can remember when you enter it a bunch of times on a daily basis).

        Now as for the time I'm on the way: well, I don't trust Joe random PC. I'd never unlock my password DB on a machine that's not at least reasonab

      • Re: (Score:2, Informative)

        by defaria (741527)
        Not necessarily. In a word - LastPass.
    • I use Password Composer [xs4all.nl] (runs as a grease monkey script, so will run under Chrome or GlimmerBlocker).

    • by Terrasque (796014)

      I prefer http://www.hashapass.com/ [hashapass.com] - even have a pretty well working bookmarklet, and it's 100% javascript. Which means that you can save the page to a local file :)

  • Same password (Score:3, Insightful)

    by stewbacca (1033764) on Monday August 16, 2010 @01:25PM (#33265516)

    I'd use the same password for everything if they all had the same basic requirements.

    • by Abstrackt (609015)

      I'd use the same password for everything if they all had the same basic requirements.

      Keepass [keepass.info]. You're welcome.

      You can generate and store passwords to your heart's content and only ever have to type one when you open the database. It will also auto-type most forms.

      • I'll give it a look (for the house). I can't use that at work, which is where I have about 18 different accounts, each with seemingly different password requirements.

        • by Abstrackt (609015)
          I'm not sure if this will help you then, but it's possible to run it portable as well. Of course, that's only if your workplace lets you run software off a stick.
      • by Jeremi (14640)

        Keepass [keepass.info]

        Don't worry, it's not a goatse link.

        • by Abstrackt (609015)

          Keepass [keepass.info]

          Don't worry, it's not a goatse link.

          Thanks for that. Even I wasn't sure!

    • by Kepesk (1093871) on Monday August 16, 2010 @01:40PM (#33265740) Homepage
      Hah, my worst enemy is a system where a password has to have:
      - at least two uppercase letters
      - at least two lowercase letters
      - at least two numbers
      - at least two symbols
      - at least 12 characters
      - no characters that repeat
      - nothing that's in your personal records
      - nothing from the dictionary that's over three characters
      - nothing from a FOREIGN dictionary that's over three characters
      - at least three characters different from your last 10 passwords

      No joke, I used a system for years that had those exact password requirements. Worse yet, I had to SUPPORT this system. Sometimes it would take a half hour for me to help someone figure out a new password.

      There is a danger in creating a password system with two many requirements, because I know very few people who used that system who didn't have their password on a sticky note on their monitor.
      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Aa1!Bb2@Cc3#

        Next passwords:
        a1!Bb2@Cc3#A
        1!Bb2@Cc3#Aa
        !Bb2@Cc3#Aa1
        etc.

        Or
        Bb2@Cc3#Dd4$
        Cc3#Dd4$Ee5%
        Dd4$Ee5%Ff6^
        etc.

        • Yah, encourage users to use an obvious pattern, good one. Then if I get one of your passwords I have it forever.

          It's already bad enough in less severe environments where people do password++number every iteration
          What is the point of enforcing password changes and history checks if you're going to use an easily guessable pattern?

          People need to realize that password policy has sharply diminishing returns, and two factor authentication is sooooooooooooooo much better than just one more character class.

          • Re: (Score:2, Insightful)

            by Anonymous Coward

            Yes, that was sort of the whole point. The stricter you make the password requirements the more likely people are to find a completely insecure way to defeat them.

            • by Abstrackt (609015) on Monday August 16, 2010 @02:35PM (#33266434)
              I like Bruce Schneier's take on this problem:

              "Simply, people can no longer remember passwords good enough to reliably defend against dictionary attacks, and are much more secure if they choose a password too complicated to remember and then write it down. We're all good at securing small pieces of paper. I recommend that people write their passwords down on a small piece of paper, and keep it with their other valuable small pieces of paper: in their wallet."

      • by TheLink (130905)
        And it's a waste of time and productivity.

        There is little security gain (or even decreased security as you mentioned).

        The users will just get compromised by malware (keyloggers etc), or phishing scams (what prevents them from entering that same password to the phishing site if they think it's a legit site?).

        It's like having a super expensive security system for a building, but people hold/open the doors for the pizza delivery guy/guy carrying stuff with both arms. Or let random cleaning staff into the most
      • the real joke is that this results in a smaller password "space" than could be possible
        since without the stack of rules you have 12((26*2)+10 +10) possible passwords but you then lose

        No repeats (which removes a swath of passwords)
        2 upper case letters (which drops possible passwords by 36*2)
        2 Lowercase letters (same deal)
        2 symbols (which drops possible passwords by 10*2)
        2 numbers (same deal)

        say 20% possible passwords drop due to being dictionary words in some language
        and i bet these passwords get changed li

      • by Jeremi (14640)

        There is a danger in creating a password system with two many requirements, because I know very few people who used that system who didn't have their password on a sticky note on their monitor.

        Not to mention that every additional requirement reduces the number of possible passwords. In the extreme case, there might only be a small number of acceptable passwords left, and it would be a simple task to generate that list and brute-force any account.

        • Re: (Score:3, Interesting)

          by John Hasler (414242)

          There is a danger in creating a password system with two many requirements, because I know very few people who used that system who didn't have their password on a sticky note on their monitor.

          Whereas they should have it in a little address book that they keep with their cash and credit cards. I mean that seriously. Use strong passwords, use a different password for every account, and write them down. Yes. I said that. Write them down. There is no other way to get ordinary people to use multiple st

    • I'd use the same password for everything if they all "secured" shit that I didn't care about people knowing (read relationship status, hobbies/interests, favorite bands, and the latest gossip on my next door neighbor). Now, if this were a story about how 75% of the passwords used for social networking and e-mail accounts are the same ones used for bank accounts and logins associated with classified/proprietary information, then I think there would be something worth worrying about.
    • Re:Same password (Score:5, Insightful)

      by SQLGuru (980662) on Monday August 16, 2010 @02:26PM (#33266312) Journal

      I use a set of passwords for varying levels of trust.

      Highly secure passwords (usually site specific and follow good password rules) for banking, email, computer accounts, etc.
      Medium secure passwords (usually follow good password rules but passwords may be used for more than one site) for trusted shopping sites (i.e. Amazon, etc.)
      Medium-Low secure passwords (may not follow good password rules but still reasonably secure against dictionary attacks) for social media and for one-off shopping sites.
      Low secure passwords (probably only stops low-motivated hackers, passwords re-used at multiple sites) for throw-away registrations and communities that have very little tie to my personal information

      It's really more for convenience than security, but in areas where I need the security, I'll put up with the hassle.

  • by sarbonn (1796548) on Monday August 16, 2010 @01:28PM (#33265562) Homepage Journal
    The problem is that a lot of people don't perceive email or social networking sites to be all that important, yet EVERYONE wants you to create a password for practically everything you do. I don't need a password to sign onto a site to look at stereo equipment, yet they force you to create one on some of those sites. On gaming sites where all I do is talk about games, I don't need 50,000 passwords for the different ones cause I don't care if someone steals my password there.

    I don't care that I don't have all that much concern for facebook's password. If someone takes my account, it would be unfortunate, but is it really the end of the world?

    Places where it might cause me economic misfortunate, well, those I care about, but everyone out there thinks that their site is so important for passwords.

    Some places, it's important. Others, not so much.

    • by jim_v2000 (818799) on Monday August 16, 2010 @01:46PM (#33265828)
      That's why I use three different passwords. One is for sites I don't care about...like registering for a forum that I only need once. The second is for things that I'd like to be more secure, like forums I visit often, Facebook, my person blog, etc. The third is for critical things like email, online banking, shopping sites like Newegg and Amazon, etc.
      • LOL! That's just as bad. If you lose the third critical password, you could be royally 0wned. Better to use three passwords and mix and match each one of them among the critical/secure and insecure things. Then if you lose one, you might lose one critical thing but not all the critical things.
        • by jim_v2000 (818799)
          That's not just as bad at all. If you didn't notice, people were getting their passwords stolen by using the same one everywhere, including the sketchy sites.
          • OK, I see your point to an extent; I was weighting the likelihood of someone having your password equally between the different critical vs non-critical sites. While the approach you're suggesting would reduce the probability of arriving at a worst-case scenario to begin with if the less-critical sites are more likely to steal your password. But considering the success of banking/email phishing (critical but sketchy) in the general populace I think my strategy still may be better in general.
    • by nschubach (922175)

      What bugs me is when you are trying to find a picture of some car part or something along that line and you find a forum where someone posted an attachment that requires login to download.

      Also, the fact that XDA forums requires login to be able to get anything worth going there for.

    • by theJML (911853)

      Seriously. There are some sites that I really don't give a crap if they're hacked and steal my password. They can have fun with it for all I care, e-mail accounts are easily created and in this day and age the only thing I use them for are 'forgotten password' requests and spam lists anyway. Hell, if these people can figure out my logins in half the places I have to sign up for just to see a picture or download a user manual or software update they can have it. I can't even remember them most of the time.

  • Yup, Probably true (Score:4, Interesting)

    by IndustrialComplex (975015) on Monday August 16, 2010 @01:28PM (#33265568)

    I'll give a bit of a hint here, I do the same thing, just with a slight variation:

    Mostly-Trusted media sites get the same password (obviously vastly different user names)
    Slashdot, Fark, Broadband Reports, etc

    Then I have my pseudo-trusted sites with their own password group:
    Demonoid, imageshack, probably others.

    Non-trusted sites get a random junk password each access = reset password
    ie: low accountability not tied to a company name with 2-3 visits/year

    My email gets its own password of 10+ characters

    Work gets its own password of whatever the hell rules they implement this week. Tech support has to deal with LOTS of reset requests since I don't write it down, but they have a different password for every freaking service and every freaking service has a different password lifetime setting.

    So aside from work, I really only have 3 passwords or so, but it helps break up the damage should one be compromised. Compartmentalized is probably the best description.

    • Re: (Score:3, Interesting)

      See, this is why math is your friend. All I have to remember is a formula. I apply that formula to whatever it is I'm signing into, which produces a different (and alphanumeric) password for every instance. Complex, unique passwords without having to write anything down anywhere.
      • Re: (Score:3, Interesting)

        by c-reus (852386)

        so if someone were to figure out that formula, he'd have access to every account you have created?

      • by nschubach (922175)

        Now there's an idea... have an app that generates a hash of the site domain and a common password and use that as the password for that site. Then all you have to do is put the domain name and your password in a box and poof, instant alphanumeric/non-dictionary password.

        Hmm.

        • LOL, you've got it backwards. Instead of applying another fucking layer of abstraction, I just use my brain. When all you've got is a hammer...
      • Algorithm or it didn't happen.

    • by happyslayer (750738) <david@isisltd.com> on Monday August 16, 2010 @02:00PM (#33266016)

      Same basic process, though different criteria for me:

      • Junk sites (one-time login for news, quick downloads, register-to-see, tech mailing lists) get the same low-end password. If I can't foresee any information that I care about going to that site, then it gets a basic throwaway. (I also misspell registration details so i have an idea if advertisers are getting that info).
      • Slashdot, forums, etc: Also low-grade. Sorry, but if someone gets their rocks off posting crap as me, I can live with it. I've got enough First Life points to keep me busy.
      • Personal email: Since I don't trust the email systems that are in the hands of others, I don't put anything on there I care about. (If someone wants to know that I'm asking my prof how to fix some code, more power to them--it'll bore them to tears.) Hence, it gets a medium-grade password.
      • Online stores: Medium grade for one-time purchases, high-grade for repeat business.
      • Own email system, bank, etc: High grade password, randomized (at least to the rest of the world) that it passes the basic dictionary-attack. For example, I somehow remember old phone numbers and bank accounts from 20 years ago (none of which are in use); add a couple of 1337-speak letters and you're in business.

      Like the parent, it's really a matter of compartmentalization and damage control. If you don't own the system, it's not completely trustworthy. If it's your system, it's only modestly trustworthy. If you're doing something criminal/embarassing/stupid, it's better to leave all notes at the bottom of the Marianas trench.

  • Paranoia (Score:2, Insightful)

    by deathtopaulw (1032050)
    This password security paranoia drives me crazy. If someone wants your shit, they're going to get it. I'll tell you all right now, I have maybe 3 online handles that pop up everywhere. I use the same basic password for each (adding a 1 to the end on occasion where it's OMG REQUIRED). I'm sure if someone started googling me, they'd find out a lot. I wouldn't even be surprised if they could manage to dig up something years ago where I may have said something to someone and just given my password because they'
  • by bradgoodman (964302) on Monday August 16, 2010 @01:33PM (#33265624) Homepage
    Password hashing let's you enter the same password for several sites, but changes it (i.e. hashes it) along with the domain name of different web sites - which means you are actually using a different password for every site

    Furthermore, since the passwords are seemingly random characters (not words, or anything sensable) - they are generally quite strong.

    "pwdhash" is the foremost system for doing this - there are several browser extensions and other tools for automating it

    See: http://cynix.org/tools/superpwdhash [cynix.org]

  • by Abstrackt (609015) on Monday August 16, 2010 @01:33PM (#33265636)
    Apparently 75% of the passwords tested were hunter2.
  • by damn_registrars (1103043) <damn.registrars@gmail.com> on Monday August 16, 2010 @01:35PM (#33265664) Homepage Journal
    I wondered how many people would see a registration form that requires an email address and a password, and interpret that to be asking them for their email password. Considering how many people fall for really atrociously bad phishing scams it wouldn't surprise me that a lot of people would give away their email passwords on registration forms either...
    • I've been involved with tech support, and have been asked for help from family and friends. Many non-computer savvy people see these registrations and think that they are *supposed* to use their email address password there. When people (including my mother) have asked me for help to setup for random online accounts where they give their Yahoo email address (for example), they frequently ask, "so I should put my yahoo password in here?"

      Even if they realize it's a second password, they will often use the s

  • Dilbert (Score:5, Funny)

    by KnightBlade (1074408) on Monday August 16, 2010 @01:37PM (#33265686)
    When it comes to passwords, this dilbert comic comes to mind- http://dilbert.com/strips/comic/2007-01-17/ [dilbert.com]
  • by rsborg (111459) on Monday August 16, 2010 @01:42PM (#33265764) Homepage
    ... don't necessarily help.

    Facebook's founder knows the importance [businessinsider.com] of social media:

    Mark used his site, TheFacebook.com, to look up members of the site who identified themselves as members of the Crimson. Then he examined a log of failed logins to see if any of the Crimson members had ever entered an incorrect password into TheFacebook.com. If the cases in which they had entered failed logins, Mark tried to use them to access the Crimson members' Harvard email accounts. He successfully accessed two of them.

    So in this case, the victims didn't even have the same password, but accidentally used the email password for Facebook. Combined with a malicious site (which Facebook was for them) this can lead to leaked passwords.

    The best solution to this is to use a password manager like 1password, roboform or KeepassX. I find 1password useful because it matches my password with the domain, preventing inadvertent entries. It's also a boon if you are developing with dozens of test and staging sites which change passwords often.

    • So long ago Facebook used to keep permanent logs of entered passwords (at least, failed or off-by-one-letter ones). I wonder what they do now.

    • That's awesome on one hand, and scary on the other. I think I'll be a little more careful when I enter passwords from now on...

    • This is actually really, really common.

      I ran a database repository for a beta test of an MMO video game some years in the past as a side project. This site ended up being used by the development team for various reasons during the beta period, and members of the QM and GM teams were also instructed as to how to log in to check certain bits of data.

      I had put in login logging to detect if people/IPs who shouldn't be there were trying to get to the data, but this had the odd side-effect of gathering a huge num

  • Well lets just... (Score:3, Interesting)

    by Rivalz (1431453) on Monday August 16, 2010 @01:52PM (#33265912)

    Password protect our bios
    Then our Hard drive
    Then our Operating System
    Then our router
    Then our ISP
    Then our Email
    Then our website
    Then our credit / bank cards (pins and codes)

    I'm all for it but the thing that bugs me is why cant we write a paragraph for our passwords or at the very least a full sentence.
    usually 8-64 characters is the min max range for a acceptable password. But what If I want my password to be the gettysburg address. Or maybe just the lyrics to a song. Why cant we have insanely complex passwords if we want? So until my password can be pi to the 100th digit dont come complaining to me when my passwords are the same for everything.

    • Re: (Score:3, Interesting)

      by Nadaka (224565)

      4#&7YagoR4fathers...

    • by Abstrackt (609015)
      If you're looking for that length wouldn't it just be easier to use a certificate instead of a long, but known value? I know very few sites use certificate-based authentication, but if you ever could use pi to the 100th digit as a password a certificate-based system would probably be easier to implement.
  • I have the same password everywhere, but I use SuperGenPass so really I don't. I only have to REMEMBER one password, but what gets sent in to each site is different and looks like mWIfG7QG or something like that.

  • but there's no reason why you can't have your own hash function in your head

    take a root password, say "penguin"

    say you are creating a password for slashdot

    so your password for slashdot is "penguinslashdot"

    but for gmail its "penguingmail"

    this is an extremely simplistic algorithm. i'm just using it as an example to show you: remember a PASSWORD GENERATING ALGORITHM, not a password. then you have a unique password for every site, but you don't have to remember 500 different passwords

    a REAL algorithm could be something like "the first letter of my root password plus the third letter of the website name's ascii character value plus 3 divided by my home phone number as a kid plus the second letter of my root password plus... etc"

    or whatever

    the actual password used for each site can be quite variable and the algorithm can still be hard to guess even with a hacker who knows three or four such passwords

    the point is: you don't need to remember a password, you need to remember a password creating ALGORITHM, in your head, that only you know, which is infinitely more secure, but no harder to remember

  • ...so little hope.

    I use now 11 different combinations of 13 different passwords at work. A unique situation, yes.

    But for personal, recreational access, I have only 16 different passwords for 22 different systems, from banking to email to social networks to my online servers. What a lot of fun. I have a list which is almost always obsolete, and keeping it in a PGP file is a nuisance. Teaching my wife how and where to open the file and get a password she hasn't used in months is no fun. She keeps a list

  • Why would I use different passwords? If one password is [stolen-guessed-hacked] everything is in jeopardy anyway. Our online security is a house of cards. I use one simple (for me, random for you) password at all these sites that have no personal data beyond an email address, another far more complex set for sites that have more information and a third for site that have financial or "real" data (my medical license, I am not a doctor or state account).
    • I noticed something similar to this when I was going back and looking at the settings that I use for accounts that I set up long ago. If someone had my hotmail password, they could easily get several of my other passwords because they were set to e-mail my passwords to my hotmail if I had "forgotten" them.

  • 12345, same as my luggage. Lots easier to remember.

  • Many people are going on about how they use a password manager or a hasher or some such which supposedly solves this problem of remebering passwords, but all they've really done is substitute one inconvenience for another. The reason people use one password everywhere is *convenience*. They do not want to remember a bunch of different passwords, or worse, forget them! Sure a password manager prevents that when you are at your computer, but now it's almost impossible to login unless you have your computer in

  • ... do we implement checks whether the login details the user just entered work on gmail, Facebook, myspace, Skype, ICQ and warn the user accordingly? ;-)

    Some trivia: on a site with domain XXXXXX.at roughly 0.5% of the registered users use XXXXXX as password (censored).

Science is to computer science as hydrodynamics is to plumbing.

Working...