The reason people still use weak passwords and the same passwords for all of their sites is because its too inconvenient to do otherwise. This is why solutions such as the one offered by Mitto (http://mitto.com) are useful...they make secure password management easy.
By using Mitto, you can create and manage strong different passwords for all of your websites, and log into them with ease from any computer. Because it's an online password solution, there is no software installation required. It's not that people don't want to be safe, or that security isn't a top priority. It's that the solutions that currently exist are too inconvenient for people.
Imperva released a list of the 20 most commonly used (and therefore worst) passwords, culled from a hacking incident that took place in December 2009 at RockYou.com, a photo-sharing and slideshow site. Reportedly, 32 million usernames and passwords were breached. (RockYou.com issued a statement indicating that it temporarily shut down its platform after the incident, and now employs encryption technology.)
Imperva posted a summary of the passwords, along with advice on how to create stronger passwords.
[UPDATE: Trustwave just published a list of the most commonly used passwords within enterprises -- which put many corporate systems at risk.]
[UPDATE: And here are the most commonly used passwords in the year 2011 -- a list which closely resembles the all-time list below!]
The most common passwords are as follows. Is yours among them?
- 123456
- 12345
- 123456789
- Password
- iloveyou
- princess
- rockyou
- 1234567
- 12345678
- abc123
- Nicole
- Daniel
- babygirl
- monkey
- Jessica
- Lovely
- michael
- Ashley
- 654321
- Qwerty
It’s notable how many people apparently use their first names as passwords. Notice how also, in the case of no. 7, the password is simply the name of the site.
[UPDATE: In another study on passwords, a Microsoft researcher conducted a cost/benefit analysis of efforts to encourage stronger passwords, and questions whether the costs of strong password management outweighs the benefits.]
For its part, Imperva observes that we have made precious little progress over the past two decades in improving passwords — long considered the Achilles heel of data security:
“The shortness and simplicity of passwords means many users select credentials that will make them susceptible to basic, brute force password attacks… Ironically, the problem has changed very little over the past twenty years. In 1990, a study of Unix password security revealed that password selection is strikingly similar to the 32 million breached passwords. Just ten years ago, hacked Hotmail passwords showed little change. This means that the users, if allowed to, will choose very weak passwords even for sites that hold their most private data.”
The greatest danger, Imperva points out, is that it wouldn’t take long for a hacker to break into a percentage of accounts using the weak passwords with a brute force attack. It’s simply a numbers game:
Citing NASA guidelines, Imperva recommends that all passwords be at least eight characters, and contain a mix of four different types of characters – upper case letters, lower case letters, numbers, and special characters such as !@#$%^&*,;” If there is only one letter or special character, it should not be either the first or last character in the password.
Of course, context is important as well. For online banking, email accounts, Website administration access, and so forth, the stronger the password, the better. However, there are countless information sites — online journals, analyst firm sites, and so on, that require password access, and fumbling with a unique strong password every time you want to read a white paper is just plain annoying.
Accordingly, Imperva advises users to “choose a strong password for sites you care for the privacy of the information you store.” If you’re concerned about being able to remember the code, here’s a little memory-jogging trick: “Take a sentence and turn it into a password. Something like ‘This little piggy went to market’ might become ‘tlpWENT2m.’”
Imperva recommends that administrators enforce strong password policy, especially if sensitive data is on the line. Another word of advice: “Make sure passwords are not transmitted in clear text. Always use HTTPS on login.” Also password files should be encrypted before being stored in a database.
Also worth consideration: requiring passphrases instead of passwords. “Although sentences may be longer, they may be easier to remember. With added characters, they become more difficult to break.”
