You’re not fooling anyone with that “123456” password of yours. “Password” isn’t much better, and sorry ladies, but “princess” is also no good. These are among the findings in a report released by Imperva, a data security firm that analyzed 32 million passwords recently exposed in the Rockyou.com breach. Not only did they identify the most common, and thus easily-guessable passwords, but they also suggested some effective methods for creating secure ones.
Rockyou.com is a website where users can develop apps to use on social networking sites. Last December, a hacker gained access to all of Rockyou’s members’ usernames, email addresses and passwords (which had been stored in plain, unencrypted text) and posted the passwords to the Internet. Given that many people use the same username and password for all of their online dealings, such as banking, the results could have been disastrous. Fortunately, the perpetrator seemed to be mainly interested in exposing Rockyou’s insufficient security, as they didn’t post the usernames or emails.
Imperva analyzed the hacked data, and compiled their findings in the Consumer Password Worst Practices report. Of the 32 million passwords involved, the ten most common were:
- 123456
- 12345
- 123456789
- Password
- iloveyou
- princess
- rockyou
- 1234567
- 12345678
- abc123
It was found that almost half of the members used names, slang words, proper words, or trivial passwords such as consecutive digits, or adjacent keys on the keyboard.
So, what sort of password SHOULD people be using?
Imperva made the following recommendations:
- It should contain at least eight characters (30% of users had passwords that were six letters or less)
- It should contain a mix of four different types of characters (i.e: upper case, lower case, numbers, symbols)
- It should not be a name, word, or contain any part of your name or email address
The report also suggests using a different password for every website, not sharing your passwords with third parties, and using the first letters of each word in a sentence as your password (For instance, “this little piggy went to market” would be “tlpWENT2m”).
“The data provides a unique glimpse into the way that users select passwords and an opportunity to evaluate the true strength of passwords as a security mechanism,” said Imperva CTO Amichai Shulman. “Never before has there been such a high volume of real-world passwords to examine.”
They say you shouldn\'t write down your password, but you can write down a clue to your password. I have a list of password clues in my wallet that no one could crack.
Here\'s my system to make a new password with an easy clue I can keep written down.
In light of recent events, I think Jay Leno is an asshole.
My new password is: assholeleno2010. My clue is \"Tonight Show\" because that\'s all I need to remind me of the password.
I might have the clue \"capita\" for the password \"fellatio.\" Get it? it works.
To remember my random passwords, I use a free encryption service, www.nolost.info.
I have over 30 email accounts, 5 FTP accounts and untold forum and e-tailer accounts. None of them have the same password and none of my passwords are real words, thus not vulnerable to dictionary attacks. They may be only \"moderately\" strong by Imperva standards, but I still doubt anyone will guess them.
If your passwords are so complex that you need to write them down, then you screwed up.
For example... Make up your own short \'key\' (onetime), something meaningful to you that you can remember... composed of caps, lowercase, number and special character if you want... ....maybe initials or first letters of your favorite phrase, with a favorite number... and, well, pick a favorite \'special character\', like ! or @ or & , etc... (onetime).
Then you\'ll have a personal key, for example: JSxxx4!
...then, for every site you need a password, pick the most obvious thing that springs to mind, like \'ford\' for Ford.com, or \'chevy\' for Chevrolet.com, and... ...combine them at those websites for a password there.
Such as... JSxxx4!ford at ford.com, and JSxxx4!chevy at chevrolet.com...
...that way you have a key you can remember and a different password for every website, that you should be able to guess, and not have to write down. Just don\'t always use the site name to combine with... words that spring to mind are good.
For CNN.com.... JSxxx4!news For DowJonesNews.com... JSxxx4!djn Etc.
Just never give out, or write down your key... remember it only, it\'s only one \'word\'.
By the way, if your password is simply any word in the dictionary, or even any \'mangled\' word like d1n0saur, or se7en ...it\'s EASILY crackable with software designed for that purpose. Don\'t use \'readable\' mangled words... the crackers have programmed lists of those... or ways to generate them. Computers do character substitutions -really- fast.
One caveat to my formula is that some websites only allow alphanumeric passwords, just letters and numbers. Some demand special characters, etc. So you\'ll occasionally need to be ready with some alternative to your \'key\'... ...like dropping the ! from JSxxx4! to get just JSxxx for those sites that want only letters and numbers. JSxxx(websiteword)
You can still use one of the encrypting password programs to store a list of them too... and there\'s usually a \"Forgot password\" link on most websites, anyway. What can be harder... is remembering your username! Sometimes it\'s email address, sometimes not... and sometimes someone else already has your choice for username. So the smart websites will send your username along with password, when you click \"Forgot password\"... or they -may- have a \"Forgot username\" link as well.