75% Use Same Password For Social Media & Email 278
wiredmikey writes "Over 250,000 user names, email addresses, and passwords used for social networking sites can easily be found online. A study of the data collected showed that 75 percent of social networking username and password samples collected online were identical to those used for email accounts. The password data was gathered from blogs, torrents, online collaboration services and other sources. It was found that 43 percent of the data was leaked from online collaboration tools while 21 percent of data was leaked from blog postings. Meanwhile, torrents and users of other social hubs were responsible for leaking 10 percent and 18 percent of user data respectively...."
Passwords (Score:5, Insightful)
As long as passwords remain the central method of authentication, this will continue.
Re:Passwords (Score:5, Funny)
My password is IAMGAY. That way, even if it got found out I can be confident no one will want to use it, because that would mean they are gay.
Re:Passwords (Score:5, Funny)
Re: (Score:2)
As it is, this was pushed in a Microsoft security Hotfix for Vista a couple years ago...
Re:Passwords (Score:5, Insightful)
My password is IAMGAY. That way, even if it got found out I can be confident no one will want to use it, because that would mean they are gay.
What if they are gay? ;)
Your comment reminds me of the best password policy I've ever heard: offensive gibberish. If someone's password is suitably embarrassing odds are quite good that they won't share it with anyone.
Re:Passwords (Score:4, Insightful)
Re: (Score:2)
So... being gay is both offensive and embarrassing?
The AC's comment just reminded me of that policy. If my comment came across as me thinking that being gay is offensive and/or embarrassing, I sincerely apologize as that was not my intention.
Re: (Score:2)
One of my passwords awhile back had very nit-picky rules for passwords. After about a dozen attempts, I finally found one it accepted. I can guarantee I would never repeat THAT password.
Counterbalance (Score:5, Funny)
What if they are gay? ;)
That's why his usernames are all something along the lines of "IAM_NOT_GAY"
It's a sort of psychosexual firewall. Only someone who can embrace being gay and not gay at once may pass.
Or Pat.
Re:Counterbalance (Score:4, Funny)
So, as a bisexual I am uniquely suited to compromise this persons account.
Re: (Score:2)
This takes Your Relationship with Anonymous Coward (666) [slashdot.org] to a whole new level (Sorry, this is not an option).
Re: (Score:2)
My password is IAMGAY. That way, even if it got found out I can be confident no one will want to use it, because that would mean they are gay
...Not that there's anything wrong with that. /seinfeld
Re: (Score:2)
My password is IAMGAY. That way, even if it got found out I can be confident no one will want to use it, because that would mean they are gay.
I think something like IB1owGoats would be better. That way, even if the hacker/cracker is a goat-blower, it's probably not the kind of thing they would be willing to admit. "Gay" just doesn't have the same stigma attached to it that it did when we were growing up.
Re:Passwords (Score:5, Funny)
hunter2
"Leaked"? (Score:5, Interesting)
So wait...how exactly did they get hold of passwords?
Re:"Leaked"? (Score:5, Interesting)
Re: (Score:3, Insightful)
Re:"Leaked"? (Score:5, Insightful)
It's pretty amazing just how much of the world is based on trust isn't it?
And it's equally tragic that it can't.
I don't think it's so much that people automatically trust each other, although that's certainly the case sometimes, it's more like it never occurs to too many people, unfortunately, that what they divulge could cause problems in the wrong hands.
For many years now, when someone asks me for information, my first thought is not to give the information, but to consider why I don't want to give it to that person. And I don't consider myself particularly paranoid with respect to what I share.
It gets tiring after awhile. Modern life in the 21st century requires a level of vigilance regarding information that probably never existed outside of the military, national security apparatus, law enforcement or some elements of business before a couple decades ago.
"Loose lips sink ships" was a common saying during World War II, but nowadays everyone must practice that level of vigilance over their own information all the time merely to be safe from criminals.
Re: (Score:2, Interesting)
>"Loose lips sink ships" was a common saying during World War II
And today we know *way* too much, in way too much detail, about the location and movement of troops, their morale, reports of their actions, etc.
Re:"Leaked"? (Score:4, Insightful)
That sounds like an argument for why porn should NOT be put on bluray and in HD!
Re: (Score:3, Insightful)
Btw I have to agree with one of the posts above, having your password be very offensive usually prevents you from sharing it at all. I do have such a password somewhere, and was horrified when a friend of mine cracked it.
Re: (Score:2)
Re:"Leaked"? (Score:5, Informative)
It's not so much about trusting a person. Although that's an exploitable component for social engineers, social engineering is fairly rare, and it doesn't scale well. It's really about the machines in which we place that trust, and how those machines can be hacked. That's the easy part to scale up.
Hackers (specifically criminal types) operate on statistics. They don't care so much "which" websites they break open, they care about breaking into "some" sites and harvesting what can be found there. They also harvest the easy stuff: cleartext passwords, cleartext account numbers, etc. They won't run a deep password cracker on a million accounts, but they might run a simple /usr/dict/words kind of scan.
Of course once you've broken a thousand passwords on socialsite.com, you can try correlating those to majorbank.com and amazon.com and all the other potential sources of money. Again, you don't care if 900 out of a thousand fail, because you can still effectively steal from the 100 that remain.
Re: (Score:2, Insightful)
It's pretty amazing just how much of the world is based on trust isn't it?
Especially since, at least in the US, we seem to have been making crime stories the prime entertainment for decades, and there's a lot of money made from fear mongering.
Re: (Score:2)
How many of those were their real passowrds?`
Re: (Score:2)
As in, people posted their passwords there and said something like "this is my password", right there in the open. As for verification, my best guess is they got the providers to agree to check the scraped list against their accounts. I don't think they'd try to log in to the accounts to verify them, as they're a reputable company and such an action w
Re:"Leaked"? (Score:4, Informative)
Use Password Hasher (Score:5, Informative)
Use firefox extension's password hasher (http://wijjo.com/PasswordHasher). Then you only need to remember one password but can use it for a variety of sites. If any one site's passwords get leaked, you dont have to go around an update your password for all other sites.
Re:Use Password Hasher (Score:5, Insightful)
And if you ever need to sign in from a computer that doesn't have firefox, and that extension, installed.....you are stuck.
Re: (Score:2)
Re: (Score:2)
Re:Use Password Hasher (Score:4, Insightful)
In Tinfoil Hat Land, if you don't have FF installed, then it's likely not a computer you control*, and if it's a computer you don't control, then should you really be entering your password**?
* It must be a machine at work, friend or family member's house, public terminal like a coffee shop, public library, etc.
** If it's not your computer, you don't know who that computer has "been with". There could be key-loggers, cookie-trackers, syphilis. Who knows!?
Re:Use Password Hasher (Score:4, Interesting)
I know IE6 is a nightmare. I don't really pay attention to IE7 or IE8 because I don't use them. I know Chrome involves some privacy issues, and I suppose there is something that has to do with selective script management. From what I hear, however, Opera and Iron are supposed to be pretty damn secure. Also, SeaMonkey is supposed to be pretty decent. I can't talk about Safari because, like IE, I really don't care about it at all.
Of course, you prefixed your post with "In Tinfoil Hat Land..." so I suppose you were being somewhat sarcastic. But I am curious, do you really think FF is the only secure browser out there?
Re: (Score:2)
The impression I got is, it's not so much the browser. It's the fact that the user doesn't control the computer. At work, I use IE7, but even if I used FF (or Opera, Iron, Lead, or whatever), I wouldn't do anything regarding important passwords (my /. pw doesn't count) on it.
Re: (Score:2)
Re: (Score:2)
So I guess Chrome, Opera, Iron, Seamonkey, and dozens of other web browsers are completely insecure?
Theoretically yes, those programs are totally insecure on any machine you do not own.
As are any other programs installed on that machine.
This is simply due to the fact that what you see isn't necessarily what you get. The machine may have any number of programs running that will hide the truth from you, steal your password as you enter it into Iron, Chrome, Opera, Seamonkey, or dozens of other web browsers.
In fact, how do you even know that you are running Opera, Chrome, or what have you on such a machine?
Re: (Score:2)
I use a password manager for password storage and generation. Stores them nicely with AES. New password for all important stuff. I also upload it to my online storage, as no-one can do anything with it without the master password (which is also long, and computer generated.. it's fascinating what you can remember when you enter it a bunch of times on a daily basis).
Now as for the time I'm on the way: well, I don't trust Joe random PC. I'd never unlock my password DB on a machine that's not at least reasonab
Re: (Score:2, Informative)
Re: (Score:2)
I use Password Composer [xs4all.nl] (runs as a grease monkey script, so will run under Chrome or GlimmerBlocker).
Re: (Score:2)
I prefer http://www.hashapass.com/ [hashapass.com] - even have a pretty well working bookmarklet, and it's 100% javascript. Which means that you can save the page to a local file :)
Same password (Score:3, Insightful)
I'd use the same password for everything if they all had the same basic requirements.
Re: (Score:2)
I'd use the same password for everything if they all had the same basic requirements.
Keepass [keepass.info]. You're welcome.
You can generate and store passwords to your heart's content and only ever have to type one when you open the database. It will also auto-type most forms.
Re: (Score:2)
I'll give it a look (for the house). I can't use that at work, which is where I have about 18 different accounts, each with seemingly different password requirements.
Re: (Score:2)
Re: (Score:2)
Keepass [keepass.info]
Don't worry, it's not a goatse link.
Re: (Score:2)
Keepass [keepass.info]
Don't worry, it's not a goatse link.
Thanks for that. Even I wasn't sure!
The danger of too many password requirements (Score:5, Insightful)
- at least two uppercase letters
- at least two lowercase letters
- at least two numbers
- at least two symbols
- at least 12 characters
- no characters that repeat
- nothing that's in your personal records
- nothing from the dictionary that's over three characters
- nothing from a FOREIGN dictionary that's over three characters
- at least three characters different from your last 10 passwords
No joke, I used a system for years that had those exact password requirements. Worse yet, I had to SUPPORT this system. Sometimes it would take a half hour for me to help someone figure out a new password.
There is a danger in creating a password system with two many requirements, because I know very few people who used that system who didn't have their password on a sticky note on their monitor.
Re: (Score:2, Insightful)
Aa1!Bb2@Cc3#
Next passwords:
a1!Bb2@Cc3#A
1!Bb2@Cc3#Aa
!Bb2@Cc3#Aa1
etc.
Or
Bb2@Cc3#Dd4$
Cc3#Dd4$Ee5%
Dd4$Ee5%Ff6^
etc.
Re: (Score:2)
Yah, encourage users to use an obvious pattern, good one. Then if I get one of your passwords I have it forever.
It's already bad enough in less severe environments where people do password++number every iteration
What is the point of enforcing password changes and history checks if you're going to use an easily guessable pattern?
People need to realize that password policy has sharply diminishing returns, and two factor authentication is sooooooooooooooo much better than just one more character class.
Re: (Score:2, Insightful)
Yes, that was sort of the whole point. The stricter you make the password requirements the more likely people are to find a completely insecure way to defeat them.
Re:The danger of too many password requirements (Score:4, Interesting)
"Simply, people can no longer remember passwords good enough to reliably defend against dictionary attacks, and are much more secure if they choose a password too complicated to remember and then write it down. We're all good at securing small pieces of paper. I recommend that people write their passwords down on a small piece of paper, and keep it with their other valuable small pieces of paper: in their wallet."
Re: (Score:2)
There is little security gain (or even decreased security as you mentioned).
The users will just get compromised by malware (keyloggers etc), or phishing scams (what prevents them from entering that same password to the phishing site if they think it's a legit site?).
It's like having a super expensive security system for a building, but people hold/open the doors for the pizza delivery guy/guy carrying stuff with both arms. Or let random cleaning staff into the most
Re: (Score:2)
1) Have a smoke.
2) Get somewhere else faster (toilet, other dept, floor etc).
But that's not analogous to malware or phishing scams, hence my analogy of pizza delivery etc.
I bet more people get pwned via "drive-by malware" or phishing or trojans than brute-forced passwords.
So what you should do is figure out which group of people are more likely to get pwned, and design/structure your security accordingly. Even if it turns
Re: (Score:2)
the real joke is that this results in a smaller password "space" than could be possible
since without the stack of rules you have 12((26*2)+10 +10) possible passwords but you then lose
No repeats (which removes a swath of passwords)
2 upper case letters (which drops possible passwords by 36*2)
2 Lowercase letters (same deal)
2 symbols (which drops possible passwords by 10*2)
2 numbers (same deal)
say 20% possible passwords drop due to being dictionary words in some language
and i bet these passwords get changed li
Re: (Score:2)
There is a danger in creating a password system with two many requirements, because I know very few people who used that system who didn't have their password on a sticky note on their monitor.
Not to mention that every additional requirement reduces the number of possible passwords. In the extreme case, there might only be a small number of acceptable passwords left, and it would be a simple task to generate that list and brute-force any account.
Re: (Score:3, Interesting)
Whereas they should have it in a little address book that they keep with their cash and credit cards. I mean that seriously. Use strong passwords, use a different password for every account, and write them down. Yes. I said that. Write them down. There is no other way to get ordinary people to use multiple st
Re: (Score:2)
Enforcing that requires a system to store your last 10 passwords in cleartext.
What? No it doesn't, you can still keep the hashed passwords and verify against that.
Re: (Score:2)
That would tell you if that exact password was previously used. He said “at least 3 characters different”.
Re: (Score:2)
Re:Same password (Score:5, Insightful)
I use a set of passwords for varying levels of trust.
Highly secure passwords (usually site specific and follow good password rules) for banking, email, computer accounts, etc.
Medium secure passwords (usually follow good password rules but passwords may be used for more than one site) for trusted shopping sites (i.e. Amazon, etc.)
Medium-Low secure passwords (may not follow good password rules but still reasonably secure against dictionary attacks) for social media and for one-off shopping sites.
Low secure passwords (probably only stops low-motivated hackers, passwords re-used at multiple sites) for throw-away registrations and communities that have very little tie to my personal information
It's really more for convenience than security, but in areas where I need the security, I'll put up with the hassle.
Problem is lack of importance (Score:3, Insightful)
I don't care that I don't have all that much concern for facebook's password. If someone takes my account, it would be unfortunate, but is it really the end of the world?
Places where it might cause me economic misfortunate, well, those I care about, but everyone out there thinks that their site is so important for passwords.
Some places, it's important. Others, not so much.
Re:Problem is lack of importance (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
What bugs me is when you are trying to find a picture of some car part or something along that line and you find a forum where someone posted an attachment that requires login to download.
Also, the fact that XDA forums requires login to be able to get anything worth going there for.
Re: (Score:2)
Seriously. There are some sites that I really don't give a crap if they're hacked and steal my password. They can have fun with it for all I care, e-mail accounts are easily created and in this day and age the only thing I use them for are 'forgotten password' requests and spam lists anyway. Hell, if these people can figure out my logins in half the places I have to sign up for just to see a picture or download a user manual or software update they can have it. I can't even remember them most of the time.
Yup, Probably true (Score:4, Interesting)
I'll give a bit of a hint here, I do the same thing, just with a slight variation:
Mostly-Trusted media sites get the same password (obviously vastly different user names)
Slashdot, Fark, Broadband Reports, etc
Then I have my pseudo-trusted sites with their own password group:
Demonoid, imageshack, probably others.
Non-trusted sites get a random junk password each access = reset password
ie: low accountability not tied to a company name with 2-3 visits/year
My email gets its own password of 10+ characters
Work gets its own password of whatever the hell rules they implement this week. Tech support has to deal with LOTS of reset requests since I don't write it down, but they have a different password for every freaking service and every freaking service has a different password lifetime setting.
So aside from work, I really only have 3 passwords or so, but it helps break up the damage should one be compromised. Compartmentalized is probably the best description.
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
so if someone were to figure out that formula, he'd have access to every account you have created?
Re: (Score:2)
Re: (Score:2)
Now there's an idea... have an app that generates a hash of the site domain and a common password and use that as the password for that site. Then all you have to do is put the domain name and your password in a box and poof, instant alphanumeric/non-dictionary password.
Hmm.
Re: (Score:2)
Re: (Score:2)
Algorithm or it didn't happen.
Re:Yup, Probably true (Score:4, Insightful)
Same basic process, though different criteria for me:
Like the parent, it's really a matter of compartmentalization and damage control. If you don't own the system, it's not completely trustworthy. If it's your system, it's only modestly trustworthy. If you're doing something criminal/embarassing/stupid, it's better to leave all notes at the bottom of the Marianas trench.
Paranoia (Score:2, Insightful)
Password Hashing (pwdhash) (Score:5, Informative)
Furthermore, since the passwords are seemingly random characters (not words, or anything sensable) - they are generally quite strong.
"pwdhash" is the foremost system for doing this - there are several browser extensions and other tools for automating it
See: http://cynix.org/tools/superpwdhash [cynix.org]
Re: (Score:2)
That's why I made my own JS Bookmarklet that hashes the domain + my_password + static_salt.
When I need to access the site from somewhere else I can easily perform the computation on the command line (md5sum, sha1sum), or online using client side javascript [pajhome.org.uk].
If I can't get online to use the online tool, and the computer doesn't have a hashing tool then I really don't need to be entering my password in the first place.
As it turns out.... (Score:5, Funny)
I have often wondered that... (Score:3, Insightful)
You wonder? I know it happens. (Score:3, Informative)
I've been involved with tech support, and have been asked for help from family and friends. Many non-computer savvy people see these registrations and think that they are *supposed* to use their email address password there. When people (including my mother) have asked me for help to setup for random online accounts where they give their Yahoo email address (for example), they frequently ask, "so I should put my yahoo password in here?"
Even if they realize it's a second password, they will often use the s
Dilbert (Score:5, Funny)
Re: (Score:2)
That's the kind of thing an idiot would have on his luggage!
It gets even worse... even different passwords (Score:5, Interesting)
Facebook's founder knows the importance [businessinsider.com] of social media:
So in this case, the victims didn't even have the same password, but accidentally used the email password for Facebook. Combined with a malicious site (which Facebook was for them) this can lead to leaked passwords.
The best solution to this is to use a password manager like 1password, roboform or KeepassX. I find 1password useful because it matches my password with the domain, preventing inadvertent entries. It's also a boon if you are developing with dozens of test and staging sites which change passwords often.
Re: (Score:2)
So long ago Facebook used to keep permanent logs of entered passwords (at least, failed or off-by-one-letter ones). I wonder what they do now.
Re: (Score:2)
That's awesome on one hand, and scary on the other. I think I'll be a little more careful when I enter passwords from now on...
Re: (Score:2)
This is actually really, really common.
I ran a database repository for a beta test of an MMO video game some years in the past as a side project. This site ended up being used by the development team for various reasons during the beta period, and members of the QM and GM teams were also instructed as to how to log in to check certain bits of data.
I had put in login logging to detect if people/IPs who shouldn't be there were trying to get to the data, but this had the odd side-effect of gathering a huge num
Original writeup and description: (Score:2)
Well lets just... (Score:3, Interesting)
Password protect our bios
Then our Hard drive
Then our Operating System
Then our router
Then our ISP
Then our Email
Then our website
Then our credit / bank cards (pins and codes)
I'm all for it but the thing that bugs me is why cant we write a paragraph for our passwords or at the very least a full sentence.
usually 8-64 characters is the min max range for a acceptable password. But what If I want my password to be the gettysburg address. Or maybe just the lyrics to a song. Why cant we have insanely complex passwords if we want? So until my password can be pi to the 100th digit dont come complaining to me when my passwords are the same for everything.
Re: (Score:3, Interesting)
4#&7YagoR4fathers...
Re: (Score:2)
SuperGenPass (Score:2)
I have the same password everywhere, but I use SuperGenPass so really I don't. I only have to REMEMBER one password, but what gets sent in to each site is different and looks like mWIfG7QG or something like that.
Re: (Score:2)
Why should I trust SuperGenPass? What happens if your site goes down?
SuperGenPass is open source. There is only one developer, but the source code is freely available and is regularly reviewed by independent programmers. As an algorithm, SuperGenPass is completely agnostic towards the input (your master password) and output (your generated passwords). All calculations and actions are performed locally by the Web browser on your computer; SuperGenPass does not transmit or store data.
In addition, this Web site does not collect or store any information. I do not keep access logs. All forms on this Web site are manipulated locally by the Web browser on your computer; they do not transmit or store data.
While my hosting service is generally very reliable, there are rare outages. If you use the Firefox / Safari / Opera version, outages will not affect your use of SuperGenPass. If you use the Internet Explorer version and you are concerned about outages, the "Customize SuperGenPass" page allows you to specify a different location for the hosted JavaScript file—your own server, the Coral cache, or the Google Code repository. I also recommend that you save a copy of the mobile version to your hard drive in case you need to generate a password while offline.
firefox has that hash function (Score:3, Insightful)
but there's no reason why you can't have your own hash function in your head
take a root password, say "penguin"
say you are creating a password for slashdot
so your password for slashdot is "penguinslashdot"
but for gmail its "penguingmail"
this is an extremely simplistic algorithm. i'm just using it as an example to show you: remember a PASSWORD GENERATING ALGORITHM, not a password. then you have a unique password for every site, but you don't have to remember 500 different passwords
a REAL algorithm could be something like "the first letter of my root password plus the third letter of the website name's ascii character value plus 3 divided by my home phone number as a kid plus the second letter of my root password plus... etc"
or whatever
the actual password used for each site can be quite variable and the algorithm can still be hard to guess even with a hacker who knows three or four such passwords
the point is: you don't need to remember a password, you need to remember a password creating ALGORITHM, in your head, that only you know, which is infinitely more secure, but no harder to remember
So many passwords... (Score:2)
...so little hope.
I use now 11 different combinations of 13 different passwords at work. A unique situation, yes.
But for personal, recreational access, I have only 16 different passwords for 22 different systems, from banking to email to social networks to my online servers. What a lot of fun. I have a list which is almost always obsolete, and keeping it in a PGP file is a nuisance. Teaching my wife how and where to open the file and get a password she hasn't used in months is no fun. She keeps a list
so do I, well three.... (Score:2)
Re: (Score:2)
I noticed something similar to this when I was going back and looking at the settings that I use for accounts that I set up long ago. If someone had my hotmail password, they could easily get several of my other passwords because they were set to e-mail my passwords to my hotmail if I had "forgotten" them.
I just use... (Score:2)
12345, same as my luggage. Lots easier to remember.
Its about convenience (Score:2, Insightful)
Many people are going on about how they use a password manager or a hasher or some such which supposedly solves this problem of remebering passwords, but all they've really done is substitute one inconvenience for another. The reason people use one password everywhere is *convenience*. They do not want to remember a bunch of different passwords, or worse, forget them! Sure a password manager prevents that when you are at your computer, but now it's almost impossible to login unless you have your computer in
so how do we educate users... (Score:2)
Some trivia: on a site with domain XXXXXX.at roughly 0.5% of the registered users use XXXXXX as password (censored).