Forgot your password?
typodupeerror
Privacy Security Social Networks Your Rights Online

75% Use Same Password For Social Media & Email 278

Posted by CmdrTaco
from the my-password-is-trustno1 dept.
wiredmikey writes "Over 250,000 user names, email addresses, and passwords used for social networking sites can easily be found online. A study of the data collected showed that 75 percent of social networking username and password samples collected online were identical to those used for email accounts. The password data was gathered from blogs, torrents, online collaboration services and other sources. It was found that 43 percent of the data was leaked from online collaboration tools while 21 percent of data was leaked from blog postings. Meanwhile, torrents and users of other social hubs were responsible for leaking 10 percent and 18 percent of user data respectively...."
This discussion has been archived. No new comments can be posted.

75% Use Same Password For Social Media & Email

Comments Filter:
  • Passwords (Score:5, Insightful)

    by geek (5680) on Monday August 16, 2010 @01:20PM (#33265472) Homepage

    As long as passwords remain the central method of authentication, this will continue.

  • Same password (Score:3, Insightful)

    by stewbacca (1033764) on Monday August 16, 2010 @01:25PM (#33265516)

    I'd use the same password for everything if they all had the same basic requirements.

  • by Anonymous Coward on Monday August 16, 2010 @01:27PM (#33265552)

    And if you ever need to sign in from a computer that doesn't have firefox, and that extension, installed.....you are stuck.

  • by sarbonn (1796548) on Monday August 16, 2010 @01:28PM (#33265562) Homepage Journal
    The problem is that a lot of people don't perceive email or social networking sites to be all that important, yet EVERYONE wants you to create a password for practically everything you do. I don't need a password to sign onto a site to look at stereo equipment, yet they force you to create one on some of those sites. On gaming sites where all I do is talk about games, I don't need 50,000 passwords for the different ones cause I don't care if someone steals my password there.

    I don't care that I don't have all that much concern for facebook's password. If someone takes my account, it would be unfortunate, but is it really the end of the world?

    Places where it might cause me economic misfortunate, well, those I care about, but everyone out there thinks that their site is so important for passwords.

    Some places, it's important. Others, not so much.

  • Paranoia (Score:2, Insightful)

    by deathtopaulw (1032050) on Monday August 16, 2010 @01:32PM (#33265614) Homepage
    This password security paranoia drives me crazy. If someone wants your shit, they're going to get it. I'll tell you all right now, I have maybe 3 online handles that pop up everywhere. I use the same basic password for each (adding a 1 to the end on occasion where it's OMG REQUIRED). I'm sure if someone started googling me, they'd find out a lot. I wouldn't even be surprised if they could manage to dig up something years ago where I may have said something to someone and just given my password because they're a friend, or whatever. It's probably there, and it's probably there for you too. Failing that all they'd have to do is find all the places I exist, and try to find the least secure one/impersonate me/whatever.

    I've lived this blasphemous insecure lifestyle on the internet for decades now, and have never once had an account compromised. Whether this is because I'm a worthless peon or because password security is bullshit is yet to be determined.

    Moral of the story: be insignificant to the point that you're considered below the bad guys. Failing that, stop fucking worrying.
  • Re:"Leaked"? (Score:3, Insightful)

    by BergZ (1680594) on Monday August 16, 2010 @01:33PM (#33265628)
    It's pretty amazing just how much of the world is based on trust isn't it?
  • by damn_registrars (1103043) <damn.registrars@gmail.com> on Monday August 16, 2010 @01:35PM (#33265664) Homepage Journal
    I wondered how many people would see a registration form that requires an email address and a password, and interpret that to be asking them for their email password. Considering how many people fall for really atrociously bad phishing scams it wouldn't surprise me that a lot of people would give away their email passwords on registration forms either...
  • by Kepesk (1093871) on Monday August 16, 2010 @01:40PM (#33265740) Homepage
    Hah, my worst enemy is a system where a password has to have:
    - at least two uppercase letters
    - at least two lowercase letters
    - at least two numbers
    - at least two symbols
    - at least 12 characters
    - no characters that repeat
    - nothing that's in your personal records
    - nothing from the dictionary that's over three characters
    - nothing from a FOREIGN dictionary that's over three characters
    - at least three characters different from your last 10 passwords

    No joke, I used a system for years that had those exact password requirements. Worse yet, I had to SUPPORT this system. Sometimes it would take a half hour for me to help someone figure out a new password.

    There is a danger in creating a password system with two many requirements, because I know very few people who used that system who didn't have their password on a sticky note on their monitor.
  • Re:Passwords (Score:5, Insightful)

    by Abstrackt (609015) on Monday August 16, 2010 @01:41PM (#33265750)

    My password is IAMGAY. That way, even if it got found out I can be confident no one will want to use it, because that would mean they are gay.

    What if they are gay? ;)

    Your comment reminds me of the best password policy I've ever heard: offensive gibberish. If someone's password is suitably embarrassing odds are quite good that they won't share it with anyone.

  • by tool462 (677306) on Monday August 16, 2010 @01:42PM (#33265772)

    In Tinfoil Hat Land, if you don't have FF installed, then it's likely not a computer you control*, and if it's a computer you don't control, then should you really be entering your password**?

    * It must be a machine at work, friend or family member's house, public terminal like a coffee shop, public library, etc.
    ** If it's not your computer, you don't know who that computer has "been with". There could be key-loggers, cookie-trackers, syphilis. Who knows!?

  • Re:"Leaked"? (Score:5, Insightful)

    by ConceptJunkie (24823) on Monday August 16, 2010 @01:44PM (#33265796) Homepage Journal

    It's pretty amazing just how much of the world is based on trust isn't it?

    And it's equally tragic that it can't.

    I don't think it's so much that people automatically trust each other, although that's certainly the case sometimes, it's more like it never occurs to too many people, unfortunately, that what they divulge could cause problems in the wrong hands.

    For many years now, when someone asks me for information, my first thought is not to give the information, but to consider why I don't want to give it to that person. And I don't consider myself particularly paranoid with respect to what I share.

    It gets tiring after awhile. Modern life in the 21st century requires a level of vigilance regarding information that probably never existed outside of the military, national security apparatus, law enforcement or some elements of business before a couple decades ago.

    "Loose lips sink ships" was a common saying during World War II, but nowadays everyone must practice that level of vigilance over their own information all the time merely to be safe from criminals.

  • by jim_v2000 (818799) on Monday August 16, 2010 @01:46PM (#33265828)
    That's why I use three different passwords. One is for sites I don't care about...like registering for a forum that I only need once. The second is for things that I'd like to be more secure, like forums I visit often, Facebook, my person blog, etc. The third is for critical things like email, online banking, shopping sites like Newegg and Amazon, etc.
  • by Anonymous Coward on Monday August 16, 2010 @01:47PM (#33265836)

    Aa1!Bb2@Cc3#

    Next passwords:
    a1!Bb2@Cc3#A
    1!Bb2@Cc3#Aa
    !Bb2@Cc3#Aa1
    etc.

    Or
    Bb2@Cc3#Dd4$
    Cc3#Dd4$Ee5%
    Dd4$Ee5%Ff6^
    etc.

  • Re:Passwords (Score:4, Insightful)

    by jDeepbeep (913892) on Monday August 16, 2010 @01:50PM (#33265870)
    So... being gay is both offensive and embarrassing?
  • Re:"Leaked"? (Score:2, Insightful)

    by aGuyNamedJoe (317081) on Monday August 16, 2010 @01:51PM (#33265882)

    It's pretty amazing just how much of the world is based on trust isn't it?

    Especially since, at least in the US, we seem to have been making crime stories the prime entertainment for decades, and there's a lot of money made from fear mongering.

  • Re:"Leaked"? (Score:3, Insightful)

    by e065c8515d206cb0e190 (1785896) on Monday August 16, 2010 @01:55PM (#33265948)
    I think the whole driving/road system is based on trust and it works quite well. It's potentially a very dangerous environment where the penalties for being reckless are not as bad as the potential damage you can cause. And yet it somehow works.

    Btw I have to agree with one of the posts above, having your password be very offensive usually prevents you from sharing it at all. I do have such a password somewhere, and was horrified when a friend of mine cracked it.
  • but there's no reason why you can't have your own hash function in your head

    take a root password, say "penguin"

    say you are creating a password for slashdot

    so your password for slashdot is "penguinslashdot"

    but for gmail its "penguingmail"

    this is an extremely simplistic algorithm. i'm just using it as an example to show you: remember a PASSWORD GENERATING ALGORITHM, not a password. then you have a unique password for every site, but you don't have to remember 500 different passwords

    a REAL algorithm could be something like "the first letter of my root password plus the third letter of the website name's ascii character value plus 3 divided by my home phone number as a kid plus the second letter of my root password plus... etc"

    or whatever

    the actual password used for each site can be quite variable and the algorithm can still be hard to guess even with a hacker who knows three or four such passwords

    the point is: you don't need to remember a password, you need to remember a password creating ALGORITHM, in your head, that only you know, which is infinitely more secure, but no harder to remember

  • by happyslayer (750738) <david@isisltd.com> on Monday August 16, 2010 @02:00PM (#33266016)

    Same basic process, though different criteria for me:

    • Junk sites (one-time login for news, quick downloads, register-to-see, tech mailing lists) get the same low-end password. If I can't foresee any information that I care about going to that site, then it gets a basic throwaway. (I also misspell registration details so i have an idea if advertisers are getting that info).
    • Slashdot, forums, etc: Also low-grade. Sorry, but if someone gets their rocks off posting crap as me, I can live with it. I've got enough First Life points to keep me busy.
    • Personal email: Since I don't trust the email systems that are in the hands of others, I don't put anything on there I care about. (If someone wants to know that I'm asking my prof how to fix some code, more power to them--it'll bore them to tears.) Hence, it gets a medium-grade password.
    • Online stores: Medium grade for one-time purchases, high-grade for repeat business.
    • Own email system, bank, etc: High grade password, randomized (at least to the rest of the world) that it passes the basic dictionary-attack. For example, I somehow remember old phone numbers and bank accounts from 20 years ago (none of which are in use); add a couple of 1337-speak letters and you're in business.

    Like the parent, it's really a matter of compartmentalization and damage control. If you don't own the system, it's not completely trustworthy. If it's your system, it's only modestly trustworthy. If you're doing something criminal/embarassing/stupid, it's better to leave all notes at the bottom of the Marianas trench.

  • Re:"Leaked"? (Score:4, Insightful)

    by socz (1057222) <socrates AT ghettobsd DOT org> on Monday August 16, 2010 @02:15PM (#33266198) Homepage Journal

    And today we know *way* too much, in way too much detail, ...

    That sounds like an argument for why porn should NOT be put on bluray and in HD!

  • by Anonymous Coward on Monday August 16, 2010 @02:26PM (#33266310)

    Yes, that was sort of the whole point. The stricter you make the password requirements the more likely people are to find a completely insecure way to defeat them.

  • Re:Same password (Score:5, Insightful)

    by SQLGuru (980662) on Monday August 16, 2010 @02:26PM (#33266312) Journal

    I use a set of passwords for varying levels of trust.

    Highly secure passwords (usually site specific and follow good password rules) for banking, email, computer accounts, etc.
    Medium secure passwords (usually follow good password rules but passwords may be used for more than one site) for trusted shopping sites (i.e. Amazon, etc.)
    Medium-Low secure passwords (may not follow good password rules but still reasonably secure against dictionary attacks) for social media and for one-off shopping sites.
    Low secure passwords (probably only stops low-motivated hackers, passwords re-used at multiple sites) for throw-away registrations and communities that have very little tie to my personal information

    It's really more for convenience than security, but in areas where I need the security, I'll put up with the hassle.

  • by digitallife (805599) on Monday August 16, 2010 @02:34PM (#33266430)

    Many people are going on about how they use a password manager or a hasher or some such which supposedly solves this problem of remebering passwords, but all they've really done is substitute one inconvenience for another. The reason people use one password everywhere is *convenience*. They do not want to remember a bunch of different passwords, or worse, forget them! Sure a password manager prevents that when you are at your computer, but now it's almost impossible to login unless you have your computer in front of you, which could be extremely inconvenient under certain circumstances, for example if you need to access an email while visiting family for dinner and didn't bring your laptop, or if you lose your computer.

    People who use one password for everything are not going to stop unless a more convenient option arises, which is unlikely to occur. I guess the people who steal passwords will always have a job!

  • Re:"Leaked"? (Score:2, Insightful)

    by natehoy (1608657) on Monday August 16, 2010 @03:02PM (#33266748) Journal

    I suspect it has more to to with the progression of concepts.

    Weapons: I had a rock, then I had a sling, then I had a bow-and-arrow, now I have a gun. I'm still hitting a target with a projectile. I take an action, something moves in roughly direction I tell it to, person or thing on other side hopefully develops a hole or wound where I intended. The method of projection and controls have changed, but the concept is the same (ready, aim, fire, yay! hit, shit! miss, target dead, target wounded, target VERY PISSED OFF).

    Transportation: I had feet, then I had shoes, then I had a horse, then I had a bicycle, then I had a car. Again, still moving about, going 2 kilometers and turning left just takes less time but is the same concept. I take an action, something moves in roughly direction I tell it to, I hopefully get where I wanted to go. The controls have changed (legs->reins->handlebar->steering wheel) but the concepts aren't different (go, stop, turn left, turn right, etc).

    Computers. I "power up" my "PC" and "monitor" and wait for my "desktop" in "Windows" to appear so I can "drag" a "cursor" then "double-click" on an "icon" on my "monitor" with a "mouse" to "open a window" so I can use a "program" called a "word processor" to write a "document" that is "saved" on a "subfolder" on an "external storage device" called "E:\" so I can "eject" the device before I pull it from my "USB port" on the USB "hub" that is plugged into my "case" and give it to a friend who can't read it because he uses "Office" on a "Mac" and my computer runs "Windows" so I needed to save it using a different "format" but I want to make sure not to "format" the "external storage device" to change the "format" but to "reopen" it and save it with a different "extension" and "file type".

    That sentence made perfect sense, right? Of course it did. To you. But that's a shitload of novel concepts that someone who hasn't spent at least a few months in front of a computer to absorb in one sitting, yes? And that's all to write one document and save it. Nothing complex at all.

    Few of these concepts have a pre-computer meaning, and when they do the analogies are distant and vague. The keyboard is analogous to a typewriter, but lacks the immediacy of space or the tactile "I push a letter, hear a bang, letter is on the paper in front of me".

    It's not only that computers are new, but that they are completely new. We're not going from handwritten paper to books. We're going from immediacy to abstraction, and doing different things, and trying to express what those things are with poor analogies to similar things we've done before.

    Look at most humans in a court of law. Look at many people when confronted with an engine that needs to be rebuilt, or even oil that needs to be changed. Watchmaking? Woodworking? Carving? Rolling a Kayak? Aviation? Knitting? Skiing? There are a lot of things that look really complex until you take the time to understand them, then you understand that they ARE really complex but not in the ways you imagined, and that "the bits I thought were complex are simple, but the bits I thought didn't exist are fucking complex" feeling will cause your brain to occasionally slide to "OFF".

    It's called "being overwhelmed with too much new information all at once, with no way for Ye Olde Monkey Brain to categorize it into the neat little categories it's been using for the last x years."

    In the case of computers, particularly if it's something you have no personal interest in but are told by someone else you need to master it.

Programmers do it bit by bit.

Working...