SplashData's annual list shows people still using easy-to-guess passwords

October 25, 2012 by Bob Yirka weblog

(Phys.org)—In what has become an annual tradition, SplashData, a company that makes productivity applications for smartphones, has released a list of passwords it claims are the most commonly used to access online applications. The list is compiled by the company using passwords that hackers have posted on various web sites to illustrate the ease with which online accounts can be cracked. SplashData refers to the top 25 passwords as the "worst passwords of the year."

The top three haven't changed from last year: "password," "123456" and "12345678." SplashData indicates that many people fear forgetting their password more than they fear hackers breaching their account. Others, perhaps responding to reports of multiple recent website hacking incidents, have resorted to trying easy-to-remember (but still easy-to-hack) such as "Jesus," "mustang," "welcome" and "ninja."

In response to the posting by SplashData, several computer security companies have posted tips to users aimed at encouraging protection of accounts with stronger passwords. Most companies persist with the tried-and-true standard of suggesting users choose passwords that mix numbers and letters, are at least eight characters long, and include punctuation characters. Experts also suggest users choose different passwords for different sites to prevent hackers from accessing all of their accounts if they happen to gain access to their single-use password. A third option is for users to choose difficult-to-remember passwords and then use a password manager application (such as SplashID Safe made by SplashData), which tracks all passwords and then enters them automatically when users log into to registered sites.

SplashData encourages people—especially those who use the same password for access to online entertainment sites such as and , and those sites that hold important bank and —to take the task of choosing a password more seriously. The company also suggests that people who are currently using one of the "listed" passwords change it immediately, or risk having their account compromised.

Explore further: Are you any good at creating passwords?

Related Stories

Are you any good at creating passwords?

January 30, 2010

There's an interesting little study that's been done by security firm Imperva, which analyzed some 32 million passwords posted online in December by some enterprising hacker.

Facebook adds 'app' passwords to site security

October 27, 2011

Facebook is ramping up security by giving people the option of setting passwords for games or other third-party applications added to pages at the leading online social network.

Password breach spreads beyond LinkedIn

June 7, 2012

More websites admitted security breaches Thursday after LinkedIn said some of its members' passwords were stolen, and experts warned of email scams targeting users of the social network.

Recommended for you

Interactive tool lifts veil on the cost of nuclear energy

August 24, 2015

Despite the ever-changing landscape of energy economics, subject to the influence of new technologies and geopolitics, a new tool promises to root discussions about the cost of nuclear energy in hard evidence rather than ...

Smart home heating and cooling

August 28, 2015

Smart temperature-control devices—such as thermostats that learn and adjust to pre-programmed temperatures—are poised to increase comfort and save energy in homes.

4 comments

Adjust slider to filter visible comments by rank

Display comments: newest first

Squirrel
not rated yet Oct 25, 2012
Password hacking is only possible because websites allow millions of login attempts rather than increase the duration with each attempt. My bank allows only three (even if identical but wrong) before you are locked out and need to request a new one sent in snail mail.
LED Guy
not rated yet Oct 25, 2012
A good point. A real person need seconds to read notification that their password was incorrect. Having a 5 second delay before you could try again wouldn't really impact a living, breathing person.

It would slow a computer to less than 20,000 guesses per day.

The more times a person makes an incorrect guess, the more time they would need to think about what password they should have entered. Add 5 seconds to the interval for each incorrect password and the number of allowable attempts falls to 187 for the first 24 hours and 264 in the first 48 hours. An interesting thought . . .
Silverhill
not rated yet Oct 25, 2012
We also need the ability to use long passwords (multiple words with spaces between). These can be easy to remember but hard to crack. See http://xkcd.com/936/ for an example.
ian_j_allen
not rated yet Oct 26, 2012
There is a guy in Norway who's toddler aged son was playing with his iPhone and the kid managed to attempt thousands of logins simply by mashing the keys. Dad thought it was ok as the iPhone was "off", but thanks to the incorrect login time penalty, he has to wait something like 1.5 years until he can attempt to login again.

The penalty is apparently hardcoded and permanent. Apple's (not at all surprising) response? Buy a new iPhone.

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.