The ten worst passwords on the web..

[Fumesucker]

http://www.gizmag.com/worst-passwords-on-the-web/13960/?utm_source=Gizmag+Subscribers&utm_campaign=34a62e87a9-UA-2235360-4&utm_medium=email

You’re not fooling anyone with that “123456” password of yours. “Password” isn’t much better, and sorry ladies, but “princess” is also no good. These are among the findings in a report released by Imperva, a data security firm that analyzed 32 million passwords recently exposed in the Rockyou.com breach. Not only did they identify the most common, and thus easily-guessable passwords, but they also suggested some effective methods for creating secure ones.

Rockyou.com is a website where users can develop apps to use on social networking sites. Last December, a hacker gained access to all of Rockyou’s members’ usernames, email addresses and passwords (which had been stored in plain, unencrypted text) and posted the passwords to the Internet. Given that many people use the same username and password for all of their online dealings, such as banking, the results could have been disastrous. Fortunately, the perpetrator seemed to be mainly interested in exposing Rockyou’s insufficient security, as they didn’t post the usernames or emails.

Imperva analyzed the hacked data, and compiled their findings in the Consumer Password Worst Practices report. Of the 32 million passwords involved, the ten most common were:

More at the link..

[Cirque du So-What]

1. Dammit, who's been mucking about in my computer?

Some of my 'golden oldies' are bandied about, and I KNOW nobody else could come up with anything so clever as my passwords!

[Pryderi]

2. Whatever Dr. Stephen Falken used in "Wargames"

[-..__...]

3. "Joshua"

[RedCloud]

4. What about "Opensaysme"?

[MineralMan]

9. Hey! You misspelled my password.

Its opensezme. Oh, noes...I've gone and exposed my password. I'm so hosed.

[hfojvt]

5. dang it! Now I am gonna have to change the combination on my luggage!

does "drinkyourovaltine" work?

[Lance_Boyle]

7. BOSCO! n/t

[RedCloud]

13. I think Kroger has Bosco!

[MineralMan]

10. I got one of those word locks for mine. I got the idea for my password

from the ad. It's "poop" Nobody will ever think of that one.

[hfojvt]

20. you'd be safer, if you took the extra precaution

of spelling it sdrawkcab

[MineralMan]

22. Great idea! I'll change it at once.

[dbonds]

6. They left off another common one 'secret'

[enlightenment]

8. I agree that we need to be more careful, but 'smart' passwords

are a royal pain in the arse to recall (and of course we're not supposed to write them down, either).

Some of their recommendations don't work, either - not every system is case sensitive, for instance, and not all of them allow the use of symbols. Add to that the average number of numbers (not number/letter/symbol combos) a person can recall is seven . . .

The security system my college uses for our online grading (for instructors) requires a minimum of eleven characters, with at least one number and one symbol (certain symbols, some cannot be used at all). I forget it every single semester - apparently everyone else does, also, because they originally made us call to have it reset; now they just let us do it ourselves . . .

Frustrating.

[MineralMan]

11. I always write those hard passwords down and carry them in

my wallet, or write them on a sticky note and put it on my desk. Nobody'll ever figure out what those are, I'm sure.

[enlightenment]

23. *snork*

:rofl:

[Lance_Boyle]

25. not the worst solution in the world

WAY better than taped to the monitor, or stuck in a desk drawer. Think about it - most of us know when our wallets have gone missing. We call banks to notify them of missing cards, etc. The same call to IT to reset a PW stored in a wallet would be simple to make, and would likely happen before whoever took the wallet has a chance to attempt machine access. If people are going to write down PWs, the wallet is PRECISELY the place to keep them.

[Q3JR4]

12. You could do what I do.

Pick a phrase like "The boys are back in town" and make it TBABIT, add some numbers, an exclamation point, and change the capitalization: "TbAbIt!954". Then change it for each thing you use it for thusly:
For Wellsfargo it would be TbAbIt!945WF.
For yahoo it would be TbAbIt!945y, etc.

Q3JR4
Disclaimer disclaimer, the preceding passwords have never been used by Q3JR4.

[MineralMan]

14. OK...logging on as you now...

[Q3JR4]

21. I suppose you could try.

:)

Turns out my password for DU (and my various email accounts) are alphanumeric and don't repeat. Fortunately I only have five different accounts, so was only forced to memorize four or five different passwords. And I've changed all my passwords recently. It's a pain but it minimizes issues with people guessing my passwords.

Q3JR4.

[Q3JR4]

24. Something else people forget about,

Remember Sarah Palin? How her email account was hacked. Turns out the hacker was able to do it because he was able to answer her password reset questions....Ooops.

To minimize the chance of this happening you could always, once again, do what I do:
If the question is, "Who is your favorite uncle?" rather than answer directly I put something snarky at the beginning. So my hypothetical answer (which I haven't actually used) would be "ThatsAStupidQuestion Uncle George".

Just make sure you can remember what you write so that if worse comes to worse you can still reset. If that seems complicated you could just lie, I don't even have an Uncle George.

Or...you know...maybe I DO.

Q3JR4.

[EnviroBat]

15. I always change my password to something that's impossible

to remember for more than 10 seconds. That way NOBODY has it!

eHU7%1fJJ43e%Il2010farT7hH1

[Jokerman]

16. I forced our users to use complex passwords...

Now, several of them have their passwords written down somewhere near their workstation.

My boss has his on a post-it note attached to his monitor.

[Lance_Boyle]

26. Tell them to keep 'em in their wallets, next to the credit cards.

No, I am not kidding.

Them's the breaks when you force secure PWs, and especially frequent changes. Mitigate the risk by storing the written-down PWs in a place where people will notice when they're missing, and will hopefully remember to inform you when it happens.

[Kerrytravelers]

17. I just forwarded this to a friend who uses 123456 for everything.

Even their ATM PIN number. :eyes:

[rucky]

18. iforgot

was the only one I could always remember

[SoCalDem]

19. I once had a boss who changed the safe combination to MY birthday

I kept forgetting, so he fixed it:rofl:

another time, a place I worked had, as the front desk computer password....
"honesty"