The Worst Passwords of 2020 Show We Are Just As Lazy About Security As Ever (zdnet.com) 128
After analyzing 275,699,516 passwords leaked during 2020 data breaches, NordPass and partners found that the most common passwords are incredibly easy to guess -- and it could take less than a second or two for attackers to break into accounts using these credentials. Only 44% of those recorded were considered "unique." ZDNet reports: On Wednesday, the password manager solutions provider published its annual report on the state of password security, finding that the most popular options were "123456," "123456789," "picture1," "password," and "12345678." With the exception of "picture1," which would take approximately three hours to decipher using a brute-force attack, each password would take seconds using either dictionary scripts -- which compile common phrases and numerical combinations to try -- or simple, human guesswork.
As one of the entrants on the 200-strong list describes the state of affairs when it comes to password security, "whatever," it seems many of us are still reluctant to use strong, difficult-to-crack passwords -- and instead, we are going for options including "football," "iloveyou," "letmein," and "pokemon." When selecting a password, you should avoid patterns or repetitions, such as letters or numbers that are next to each other on a keyboard. Adding a capital letter, symbols, and numbers in unexpected places can help, too -- and in all cases, you should not use personal information as a password, such as birthdates or names.
As one of the entrants on the 200-strong list describes the state of affairs when it comes to password security, "whatever," it seems many of us are still reluctant to use strong, difficult-to-crack passwords -- and instead, we are going for options including "football," "iloveyou," "letmein," and "pokemon." When selecting a password, you should avoid patterns or repetitions, such as letters or numbers that are next to each other on a keyboard. Adding a capital letter, symbols, and numbers in unexpected places can help, too -- and in all cases, you should not use personal information as a password, such as birthdates or names.
12345 (Score:4, Funny)
Re: (Score:2)
What is secured? (Score:4, Insightful)
No one asks: what is secured by these passwords? Not everything is valuable enough to bother securing with a strong password.
Re: (Score:2)
Exactly. Every web site wants to have you create a login and password these days, whether I'm ever going back there or not. So web sites that demand this shit for no reason get bullshit answers - a throwaway email address, and a shitty password that is just good enough to get past their regex.
Anything even remotely important gets a real password, generated by my password manager of choice.
Re: (Score:1)
ah but I'm so clever and use 54321
Re:12345 (Score:5, Funny)
Re: (Score:1)
only my AzureDiamond account uses that
Re: (Score:2)
That's the area code for Earth in the intergalactic phonebook.
Re: (Score:2)
No it isn't! I reversed it!
Re: (Score:2)
You can still do this? (Score:2)
Re:You can still do this? (Score:5, Insightful)
Consider this... these are from password dumps.
Any site smart enough to force those restrictions would use salted hashed passwords, preventing these types of discoveries even if the DBs leaked.
So, yeah, not surprised in the least that sites that are exploited are also sites that dont have strong requirements.
Re:You can still do this? (Score:4, Interesting)
Re: (Score:3)
There was one site, which I will not name, that did some sort of financials. It required 6-8 characters, alphanumeric, first character alphabetic. No special characters. No long passwords. An exhaustive search would be something like a quarter of a quadrillion passwords, and would find every single password.
Re: (Score:2)
Re: (Score:2)
and it could not start with 0. Especially that last one is totally bonkers, reducing entropy by 10% because... why exactly?
Probably somewhere along some codepath the thing is converted to an integer and back to a string again, leading to a mismatch between "0111" and "111".
It would be a stupid state of affairs, but that would be my guess.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Banking site using user selected password? That's not secure.
The bank I have requires a one time password generated by a dongle that has a display and can't be connected to the computer.
Re: (Score:2)
Re: (Score:2)
Not much of a pain compared to the pain you will get for losing the contents of your bank accounts.
B.t.w. I'm in Sweden too.
Re: (Score:2)
Re: (Score:2)
Consider this... these are from password dumps.
The takeaway is, this is a highly biased sample, and these results cannot be used for any generalized conclusions. Therefore, we can't make any claims like, "We Are Just As Lazy About Security As Ever."
Re: (Score:2)
Re: (Score:3)
That's just proving the point, that password complexity rules are pointless.
https://xkcd.com/936/
Come up with a mnemonic for your non-important sites, and a different one for your important sites, and also hope your important sites aren't stupid and prevent brute forcing.
I have a bridge you sell you in manhattan if you think the weakness is just the password. It's also the username. If I use kissmyass for my bank sites and social media, someone is going to try try that username, no password dump required. T
Re: (Score:2)
Often the admins add all kinds of rules to your password so that even my autogenerated passwords are rejected at places, and certainly the 4 word passwords. The only way out then is relying on password storage.
I also once used layered passwords: all my simple accounts used the same password, more important accounts were different though.
Re: (Score:2)
The huge problem here is that there are so many different sites people log on to today. In addition to that many accounts at their workplace require changing password several times per year and then it's causing new problems with people not remembering their password unless they have a method/pattern to work with.
CorrectHorseBatteryStaple (Score:4, Informative)
https://xkcd.com/936/
Re: CorrectHorseBatteryStaple (Score:2)
The password rules at my work prohibit you from using dictionary words longer than 3 letters. So that's out, unless I want to do something like Abewasshtdedinhed1! (Gotta have the nukber and special character in there, you know)
Re: (Score:2)
Re: (Score:2)
> The password rules at my work prohibit you from using dictionary words longer than 3 letters.
And those are bad rules. Like the xkcd comic correctly says, it only leads to passwords that are easy to guess and hard to remember. And the harder they are to remember, the more likely they'll be written on a sticky in the top right hand drawer. (Reference at least two films -- see if you can guess them -- but happens a lot in real life, too.)
I'm actually happy to say that my company recently switched to pa
Re: (Score:2)
Yep, I haven't seen too many stickies at work, but those that have them, are usually things like "Welcome123!" and "Laptop123!"
Re: (Score:2)
Yep, I haven't seen too many stickies at work, but those that have them, are usually things like "Welcome123!" and "Laptop123!"
Or, if you're required to change your password monthly, include capitals and a number and never repeat, use Jan2020, Feb2020, Mar2020... Dead simple to remember and won't repeat in the lifetime of civilization.
Life finds a way.
Oh, on finding stickies, look under the keyboard.
Re: (Score:2)
And the harder they are to remember, the more likely they'll be written on a sticky in the top right hand drawer. (Reference at least two films -- see if you can guess them -- but happens a lot in real life, too.)
Sneakers and Wargames.
Re: (Score:2)
And the harder they are to remember, the more likely they'll be written on a sticky in the top right hand drawer. (Reference at least two films -- see if you can guess them -- but happens a lot in real life, too.)
Sneakers and Wargames.
I haven't seen Sneakers, I'll put it on the list. I was thinking of Wargames ("pencil") and Alfred Hitchcock's Marnie.
Re: (Score:2)
And the harder they are to remember, the more
likely they'll be written on a sticky in the top right hand
drawer.
I can't help wondering how often that actually
leads to a password breach, given that the hacker isn't
even remotely likely to live in the same country,
let alone have a chance to open someone's desk.
I think probably around 0%.
Re: (Score:2)
Obligatory XKCD password comic: https://xkcd.com/936/ [xkcd.com]
Sadly when users finally wise up and start creating strong passwords, the #1 password on the Humans Suck at Passwords list will be exactly correcthorsebatterystaple...which naturally every multi-million dollar strong password checker in the known universe will allow, simply because the Learn-To-Code lead programmer is a rather huge fan of certain nerdy comic strips...
Re: (Score:2)
Re: (Score:2)
Obligatory XKCD password comic:
https://xkcd.com/936/ [xkcd.com]
Sadly when users finally wise up and start creating strong passwords, the #1 password on the Humans Suck at Passwords list will be exactly correcthorsebatterystaple...which naturally every multi-million dollar strong password checker in the known universe will allow, simply because the Learn-To-Code lead programmer is a rather huge fan of certain nerdy comic strips...
Um um... excuse me I have to go change something...
Re: (Score:2)
Obligatory XKCD password comic: Password Strength [xkcd.com]
Whelp, that solves the mystery of Trump and: Person, woman, man, camera, TV [wikipedia.org]
Re: (Score:2)
The XKCD method is only good advice where you have no choice but to memorize a password, e.g. your computer login or password manager password.
In most other cases there are better options. All major browsers have a password manager built in and will sync between devices. Obviously enable 2 Factor Authentication (2FA) wherever you can.
Long random passwords are actually easier and less effort than XKCD style phrases these days, at least for anything web related.
Re: (Score:2)
Four-letter password in a bigger alphabet.
Instead of remembering four things, remember one. Phrases can be as simple as a nursery rhyme (eg rrybgdts). We're willing to mnemonic for the order of the planets or the musical score or literally anything in higher ed curriculum but not passwords?
<ERROR - Incorrect Password> Please re-enter your password. Check the 'Caps Lock' key is not active. You have 2 attempts remaining...
The worst of them all (Score:3)
"maga2020!" https://it.slashdot.org/story/... [slashdot.org]
Re: (Score:2)
What about ****,****?
Why would anyone use just a bunch of asterisks for their password?
No, fucknugget Slashdot, this isn't ASCII art. You all will just have to pretend that the comma isn't there.
Re: Really? (Score:2)
Their problem (Score:2)
Re: (Score:2)
Tangentially. if I end a sentence with '/.', do I need a closing period?
You need to properly source it . . . so the correct syntax is '. /.'
Re: (Score:2)
You made me chuckle with the parenthetical smiley. :))
I often want to put an ASCII smile at the end of a parenthetical. It doesn't quite work. (But I'll do it anyway.
How I do it. (Score:2)
Re: (Score:2)
I always use two words that have nothing to do with anything, usually random things seen around the cubicle...
That's one reason I have my doubts about the XKCD scheme. In theory they might be random words with 11 bits of entropy each, in practice I suspect the pool of words to be much smaller, with most people picking something like "monitorkeyboardmouselamp".
Maybe it's a sign of a different problem (Score:4, Insightful)
Perhaps the issue is that people are required to have accounts/passwords for far too many things. If forced to login to a website just to see content or browse (not purchase) items, then people don't care about security nor about creating a secure password. The proliferation of web sites requiring accounts for no good reason versus ones that people actually care about would weight the counts of passwords people don't care about much higher in such lists.
Slashdot is a good example. I was able to post as AC for years without ever having an account. Only recently was I finally forced to create one. I get pretty much no benefit from it other than being able to do what I had for two decades before they required it.
We still doin this?? (Score:1)
Passwords, really?? That's so 1990s. Why haven't we killed the damn things yet? By now everything should use passphrases, authenticator apps, 2FA, thumb/face recognition, public keys, mouse/keyboard movement digests, or punch-the monkey-to-win codes. Anything is better than passwords.
Eight characters, arcane combinations that are impossible to remember (password must contain: capitals! punctuation! no not that punctuation! voiceless fricatives followed by an alveolar stop, but only every other Tu
Re: (Score:2)
By now everything should use passphrases, authenticator apps, 2FA, thumb/face recognition, public keys,
mouse/keyboard movement digests, or punch-the monkey-to-win codes.
An interesting variation is passfaces, where a person
memories a random face, they has to pick it out from
a crowd of other random faces. This is then repeated a
number of times. This is effective since
once a person memorizes a face, they will likely
remember it for many years to come.
The Ultimate News at 11 (Score:2)
The Humans Suck At Passwords list from 1990 is the same as it is today. Instead of publishing I-Told-You-So shit-lists, perhaps we in IT should simply stop assuming users would ever wise up. Hell, at least take a note from those in Insurance; they have stupid humans figured out to a highly profitable science.
Go ahead. Look at the Best Worst Passwords lists from 10 years ago. Then 20. Then 30. Those with the same sources of grey in their beards already know I'm right.
Perhaps one day We can be smart eno
Re: (Score:2)
The best thing IT can do is switch to passphrases.
Re: (Score:2)
Perhaps one day We can be smart enough to start blaming the morons running all of the websites that still accept bullshit passwords. I mean hell, it's not like this is a Solve-for-IPv6 problem (speaking of MFA adaptation) to correct permanently.
Perhaps some day we can compare the cloud people who give away credit card information of millions of people and think thats a more important weak link than grandma's computer with "Password1".
Meanwhile, tonight I'm messing with setting up a VPN connection that the guy doesn't have a certificat for yet, and my computers are screaming at me every step of the way Security theater has come to computers near you!
Re: (Score:2)
Perhaps one day We can be smart enough to start blaming the morons running all of the websites that still accept bullshit passwords. I mean hell, it's not like this is a Solve-for-IPv6 problem (speaking of MFA adaptation) to correct permanently.
Perhaps some day we can compare the cloud people who give away credit card information of millions of people and think thats a more important weak link than grandma's computer with "Password1".
Perhaps one day the simple luddites will actually read the EULA, and realize they probably agreed to give their cloud data away. If you're talking about massive data breaches, that's another matter entirely. A 30-character randomly generated password turns into shit just as easily as "Password1" does when published unencrypted/unhashed online. Perhaps one day we'll fire the idiots who favor backwards compatibility above all, and couldn't figure out how to use a salt shaker if the password hashing machine
Re: (Score:2)
Perhaps one day the simple luddites will actually read the EULA, and realize they probably agreed to give their cloud data away. If you're talking about massive data breaches, that's another matter entirely.
It's data breaches. The apparent ease with which the bad guys can get millions of Credit card numbers is breathtaking. Why go after me and get one, while entire cities worth of people are there for the picking?
Low hanging fruit and a hella lot more of it than the 1 Card stored on individual's computers. This is the problem with remote data storage, AKA the cloud. You have to trust that the people running it are smarter than the people trying to breach it. They aren't. I don't consider myself very smart. B
Re: (Score:2)
I don't care enough to have a good password (Score:5, Insightful)
Any company that expects you to remember more than 1 password that has a capital, lower case, number, a special character and for you to change the password every month is setting themselves up for people to use weak passwords. I did a survey at one security company and discovered over 75% of the employees were willing to admit their password was a common 6 letter word in either English or their first language with the first letter capitalized, '!' or '#' and then a number they incremented every month (the special character and number could also be reversed). There were 15000 employees. An attacker was rate limited in trying passwords for a specific employee but if they didn't care which employee they compromised they could try Purple!3 on every single account in about 2 seconds. At one try every 2 seconds the rate limiter would not be tripped so effectively they could try 7500 passwords a second.
Re: (Score:2)
What's your login for Netflix since you don't care? :P
Re: (Score:3)
My WiFi router doesn't have a password
I understand and agree with most of your sentiments above, but you really should use a good password on your router as well.
There are various browser exploits that can give an attacker access to the LAN interface of your router. If the admin password on your router is easy to guess, they can (among other things) change your DNS server IP to redirect your lookups to a DNS server they control. This, in turn, can allow them to trick you into entering one of your strong passwords a webpage that looks just
Re: (Score:2)
I use strong random passwords for every site, but only because I'm lazy. It's quicker to just have the browser generate a password and save it than to type it in manually every time.
It's literally quicker and less effort to use good passwords now.
What's a "senha' ? (Score:2)
WTF does that even mean? And it's got 60K+ in their sample size.
Re: (Score:2)
It means 'password' in Portuguese, which is partly why it might be common in certain places... Why on earth it showed up so frequently on the list when the equivalent in other languages, like 'ji32k7au4a83', didn't is beyond me though.
Re: (Score:2)
when the equivalent in other languages, like 'ji32k7au4a83',
What language is that?
Re: (Score:2)
when the equivalent in other languages, like 'ji32k7au4a83',
What language is that?
Welsh, of course ;-)
There are many easy to remember mnemonics (Score:4, Insightful)
Or you might remember a particular score in Superbowl. Dc52Bb17 is a decent core password.
Or you might remember the stock option strike price you got when you joined, like 2500InTc245.
Turn on 2FA if it is offered.
Do not use same formula for important sites like banks and brokerage houses.
You do all this and your spouse decides the wedding anniversary is the "best" password for the joint account, and you look like John Keats in La Belle Dame Sans Merci.. Hey JkLbdsm is also not a bad core password.
Re: (Score:2)
So I guess the ultimate question for someone holding this level of password wisdom is...just how often have you found your strong passwords, sitting on display in public pwned sites?
Sarcasm aside, one does have to assume you've had good results securing your online world for a while now.
After forcing monthly password changes (Score:2)
my password grew from
1234
to
1234567890qwertyuiop
Re: (Score:2)
A critical password (racf) that we only used two or three times a month required a capital letter and a number, and you could never reuse a password.
Through experimentation we discovered that the following would work:
Jan97
Feb97
Mar97
Apr97
swordfish (Score:2)
Just sayin'.
Re: swordfish (Score:2)
When it comes to password security... (Score:1)
Re: (Score:1)
what a log of hogwash. When someone cracks your password manager you are truly toast.
Re: (Score:2)
And what is more common? Password leaks from insecure services (as I write this, HaveIBeenPwned records 10,240,427,866 leaked accounts), or a keylogger being installed?
My password manager is not a cloud based one (so no fear of it being left insecure and get stolen), and the master password is almost 60 bytes long. I b
Re: (Score:2)
Passwords where no one cares (Score:2)
These are passwords for systems where users don't care about security and passwords, are, essentially useless (enforced by system administrators for whatever reason). Meaning - might as well post them right next to the login box.
Sigh (Score:2)
But we need to be honest - what is the point of all this when retailers and the presumably impregnable fortress of the cloud simply gives our credit cards away by the millions?
We can rail on about the stupid stupid users, howbow we do something about the real problem.
This one rates "Excellent" (Score:2)
LGBTQIA+
follow your passion (Score:2)
Use a password manager (Score:2)
Seriously people, stop all schemes of creating hard to guess, easy to remember passwords. We are not made to remember passwords!
Password size is important, but less than having unique passwords for each service. It does not matter if your password is 100 bytes long, but you have it for every single service, and one of them stores passwords in plain text and gets hacked. And forget about creating a way to ge
Re: (Score:2)
Assuming that you always log in from the same device. If you use different devices, you have to be able to get at least compatible password managers on each one, and the devices have to communicate with each other. If you have the same manager on multiple devices, and they all die at once (say, in a house fire), you're screwed.
There's downsides to everything.
The real reason why everyone's lazy with passwords (Score:5, Insightful)
Why the hell should anyone put effort into coming up with strong passwords when a hacker is just going to steal them anyway? If your login security doesn't at least include some sort of 2FA, it's worthless. And before you say it, fuck password managers. Getting locked out of all of my accounts because some app fucked up is not my idea of a good time.
Rob
Re: (Score:2)
Most stolen passwords are hashed and salted. The hacker has to decrypt them and they always start with a dictionary attack on the most common ones. Dictionary attacks usually crack 80% or more of hashed passwords.
If you chose a decently strong password the chances are they won't bother with you, it's not worth the effort to crack it via brute force. There are millions of weaker ones to target.
It's like putting a decent lock on your door. It's not impossible to pick and people sell tools to make picking it q
Re: (Score:2)
Why the hell should anyone put effort into coming up with strong passwords when a hacker is just going to steal them anyway?
That isn't a foregone conclusion. 275 million passwords isn't a lot when data dumps are able to access them millions at a time from a single website. There are a lot of shitty websites out there and the Venn diagram of websites which have their passwords posted online and websites which have at least the common sense to demand a minimum level of complexity doesn't overlap much.
12345 (Score:2)
https://www.youtube.com/watch?... [youtube.com]
Trotting out the weak password trope again (Score:2)
STANDARD WEAK PASSWORD REPLY FORM
Passwords are weak because
[] The human mind can store very few passwords like "iGDjgGc@!Q04#Gs"
[] everybody including their dog requires a password for people to user their site
[] People don't like having to remember
which unique password goes to what
[] And people really hate being forced to frequently change their passwords
\_and if you force this, passwords written on Post-It notes will be taped to every computer monitor in your office
[] Some people can't be
Re: (Score:2)
A nice eight or twelve line poem with a few words switched out for ones you would never forget is virtually uncrackable for any purpose an average person would have, and easy to remember.
Re: (Score:2)
Sounds like a 1970s typing teacher's idea of hazing to me, not practical security advice.
Re: Trotting out the weak password trope again (Score:2)
Back in high school, when we were taught typing class (on TYPEWRITERS), the author of the lesson book decided it would be fun for students to type in a very tedious sequence of characters to make some sort of lame ascii art.
And no, the 'picture' did not come out quite well for me, and I imagine for others in the class as well.
on passwords... (Score:3)
Ah, the usual nonsense...
Here's the thing, or rather, things: First, brute-force is essentially a non-issue. It is quite rare to see actual brute-force attempts, and if your software allows brute-force, it's broken. Plain and simple. The only brute-force attacks that aren't easily defeated by not being a complete idiot are the ones on stolen hashes - and then you've already fucked up by having your hashes stolen. You probably also didn't hash, salt and pepper them properly, at least when we look at the sheer number of credentials that get lost due to hacks every year.
Second, brute-force times are misleading. Nobody who isn't completely braindead does the kind of brute-forcing that you calculate there. All of the brute-force tools know to start with common words, have a library of common permutations, etc. etc.
Third, users pick stupid passwords very often not because they're stupid, but because they don't care. Your silly website that I'm going to visit once in my life and that forces me to make an account so I can see or download the content I came for? I don't care if my password on that gets hacked. In fact, I use the same password for all such sites, because I couldn't care less. I use strong passwords for sites I care about. My e-mail is in plenty of those hacks of badly secured websites that also couldn't store their passwords securely - but none of my actual passwords for sites I actually care about are.
Fourth, for things that matter, turn on 2FA already. Done.
Fifth, for things that don't matter enough for that, length beats complexity. End of discussion. Ignore those "password strength" meters. Half of them think that AAaa11!! is a very strong password. I haven't tried but I'm reasonably sure that John cracks that in half a second tops.
Re: (Score:2)
I think it was 1999 - give or take a year.
Pissing people off (Score:2)
The very existence of passwords is pissing people off. On the one hand, the fact that some people can't mind their own business necessitates passwords. But on the other, you wind up with draconian password rules that require 20-character passwords with no repeats and have to be changed every few months while disallowing the last ten passwords you used. Ultimately, people are stupid and nefarious people will take advantage of that fact.
Obligatory XKCD reference (Score:2)
Who is we? (Score:2)
There is a sucker born every day. New idiots come online all the time. "We" is not a fixed set of people.
PEBCAK (Score:2)
P roblem
E xists
B etween
C hair
A nd
K eyboard
It seems that things haven't improved in the intervening 40-odd years.
A proposal : since the "cloud" knows everything about you, stop making people choose hard passwords for things like their bank account or pacemaker, and simply use "the cloud" to apply the objectively worst password you have used in the last 5 years to your most important log-ins.
OK, a few million
It's not about cracking anymore (Score:2)
The biggest risk to authentication security these days is not brute force attacks, dictionary attacks, rainbow table attacks or weak crypto. It is credential stuffing.
Bad actors can get lists of hundreds of thousands of username/password combinations that are valid somewhere and then try them all on thousands of new sites every day. If there is one match, which would be because someone reused both username and password on more than one site, then they've got a toe in the door to test the app for more securi
we're not lazy (Score:2)
we're not lazy at all. we (users) just don't agree on the importance of security.
I drive on a highway at 100kph with on-coming at an opposing 100kph risking 200kph collisions, my only security being a stripe of yellow paint.
I have a deadbolt on my front door, right next to a big glass window.
My air conditioner can be turned off by anyone walking by, no matter the temperature.
My furnace's exhaust vent can be plugged by anyone at any time.
My car's windshield wipers can be just taken by anyone in any parking
Re: (Score:2)