SplashData's annual list shows people still using easy-to-guess passwords

Oct 25, 2012 by Bob Yirka weblog

(Phys.org)—In what has become an annual tradition, SplashData, a company that makes productivity applications for smartphones, has released a list of passwords it claims are the most commonly used to access online applications. The list is compiled by the company using passwords that hackers have posted on various web sites to illustrate the ease with which online accounts can be cracked. SplashData refers to the top 25 passwords as the "worst passwords of the year."

The top three haven't changed from last year: "password," "123456" and "12345678." SplashData indicates that many people fear forgetting their password more than they fear hackers breaching their account. Others, perhaps responding to reports of multiple recent website hacking incidents, have resorted to trying easy-to-remember (but still easy-to-hack) such as "Jesus," "mustang," "welcome" and "ninja."

In response to the posting by SplashData, several computer security companies have posted tips to users aimed at encouraging protection of accounts with stronger passwords. Most companies persist with the tried-and-true standard of suggesting users choose passwords that mix numbers and letters, are at least eight characters long, and include punctuation characters. Experts also suggest users choose different passwords for different sites to prevent hackers from accessing all of their accounts if they happen to gain access to their single-use password. A third option is for users to choose difficult-to-remember passwords and then use a password manager application (such as SplashID Safe made by SplashData), which tracks all passwords and then enters them automatically when users log into to registered sites.

SplashData encourages people—especially those who use the same password for access to online entertainment sites such as and , and those sites that hold important bank and —to take the task of choosing a password more seriously. The company also suggests that people who are currently using one of the "listed" passwords change it immediately, or risk having their account compromised.

Explore further: Britain's UKIP issues online rules after gaffes

Related Stories

Are you any good at creating passwords?

Jan 30, 2010

There's an interesting little study that's been done by security firm Imperva, which analyzed some 32 million passwords posted online in December by some enterprising hacker.

Password breach spreads beyond LinkedIn

Jun 07, 2012

More websites admitted security breaches Thursday after LinkedIn said some of its members' passwords were stolen, and experts warned of email scams targeting users of the social network. ...

Online passwords are insecure: study

Apr 03, 2012

Online passwords are so insecure that one per cent can be cracked within 10 guesses, according to the largest ever sample analysis.

Facebook adds 'app' passwords to site security

Oct 27, 2011

Facebook is ramping up security by giving people the option of setting passwords for games or other third-party applications added to pages at the leading online social network.

Recommended for you

Britain's UKIP issues online rules after gaffes

15 hours ago

UK Independence Party (UKIP), the British anti-European Union party, has ordered a crackdown on the use of social media by supporters and members following a series of controversies.

Sony saga blends foreign intrigue, star wattage

15 hours ago

The hackers who hit Sony Pictures Entertainment days before Thanksgiving crippled the network, stole gigabytes of data and spilled into public view unreleased films and reams of private and sometimes embarrassing ...

Digital dilemma: How will US respond to Sony hack?

Dec 18, 2014

The detective work blaming North Korea for the Sony hacker break-in appears so far to be largely circumstantial, The Associated Press has learned. The dramatic conclusion of a Korean role is based on subtle ...

User comments : 4

Adjust slider to filter visible comments by rank

Display comments: newest first

Squirrel
not rated yet Oct 25, 2012
Password hacking is only possible because websites allow millions of login attempts rather than increase the duration with each attempt. My bank allows only three (even if identical but wrong) before you are locked out and need to request a new one sent in snail mail.
LED Guy
not rated yet Oct 25, 2012
A good point. A real person need seconds to read notification that their password was incorrect. Having a 5 second delay before you could try again wouldn't really impact a living, breathing person.

It would slow a computer to less than 20,000 guesses per day.

The more times a person makes an incorrect guess, the more time they would need to think about what password they should have entered. Add 5 seconds to the interval for each incorrect password and the number of allowable attempts falls to 187 for the first 24 hours and 264 in the first 48 hours. An interesting thought . . .
Silverhill
not rated yet Oct 25, 2012
We also need the ability to use long passwords (multiple words with spaces between). These can be easy to remember but hard to crack. See http://xkcd.com/936/ for an example.
ian_j_allen
not rated yet Oct 26, 2012
There is a guy in Norway who's toddler aged son was playing with his iPhone and the kid managed to attempt thousands of logins simply by mashing the keys. Dad thought it was ok as the iPhone was "off", but thanks to the incorrect login time penalty, he has to wait something like 1.5 years until he can attempt to login again.

The penalty is apparently hardcoded and permanent. Apple's (not at all surprising) response? Buy a new iPhone.

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.