You definitely don’t want to be using these

  • IllNess@infosec.pub
    211·
    11 days ago

    Hackers (1995) taught me the four most commonly used passwords are “love”, “sex”, “'secret”, and “god”.

    “secret” is there. “iloveyou” has love in it.

    I wonder how true that actually was in the 90s.

    • lemmyng@piefed.caEnglish
      17·
      11 days ago

      Before password composition rules, those were actually quite common, as well as passwords that were just the same as the username. Heck, it wasn’t until that long ago that router manufacturers used to ship with admin/admin as the default credentials.

      • Ptsf@lemmy.world
        7·
        11 days ago

        Honestly every networking company that couldn’t be bothered to ship with randomized creds physically embedded/etched somewhere on the device should’ve probably went out of business. The cost has always been minimal and the increased security value has always been readily apparent.

  • floofloof@lemmy.ca
    18·
    11 days ago

    according to data from the password security website called NordPass all of which would take a hacker less than a second to crack. Take a look at this quality design to learn about popular passwords that you definitely shouldn’t use such as 123456 which was used 3 million times, 123456789 which was used 1.6 million times, 12345678 which was used 885 thousand times, “password” which was used 692 thousand times and qwerty123 which was used 643 thousand times.

    Is it normal for a password manager to be able to recognize which passwords are being used? Does this reflect badly on NordPass?

  • who@feddit.orgEnglish
    10·
    11 days ago

    I’m a little surprised not to see “changeme” on this list.

    • Cousin Mose@lemmy.hogru.ch
      7·
      10 days ago

      From my experience brute forcing passwords, no. It’s smart enough to try character substitutions and it annoys me so much that the FBI recommends this practice.

      • psx_crab@lemmy.zipEnglish
        2·
        10 days ago

        Wait it’s not? I remember some people in the industry recommend this sort of password albeit with variation of other random words as it’s pretty strong and would take a very long time to crack.

        • locuester@lemmy.zipEnglish
          3·
          10 days ago

          Indeed, just four impersonal words is a great password. Mix up the capitalization and it’s even better.

        • Cousin Mose@lemmy.hogru.ch
          23·
          10 days ago

          If it’s a bunch of words found in any dictionary then with or without character substitution it’ll be easy to crack.

          • itslilith@lemmy.blahaj.zone
            41·
            10 days ago

            It’s not. A dictionary has on the order of ≈100,000 (10^5) words in it. Picking five words entirely at random gives you 10^25 combinations, which is about the complexity of 14 alphanumeric characters. So pretty secure.

      • psx_crab@lemmy.zipEnglish
        3·
        10 days ago

        Need your credit card number and the 3 digit number at the back of the card to see what i typed.

    • itslilith@lemmy.blahaj.zone
      3·
      10 days ago

      That’s okay at best. Better if a passphrase, just random, impersonal words, something like this (~50 bits of entropy):

      “virtual raging vineyard clad runner”

      Best is a long, completely random string, stored in the password manager that you should be using anyways ~150 bits of entropy):

      “hX0hZ1QTWtQo(h[Ta9jH]TmsVIhUTgSE”

  • sga@lemmings.worldEnglish
    8·
    10 days ago

    I am really surprised some common shit is not there, like hello, hello1234, abcd1234 (and other perms have numbers in front, etc)

  • Lenny@lemmy.zip
    8·
    11 days ago

    I see password and password1

    Mfw I’m sittin’ safe all the way down here at password69 😎

  • ns1@feddit.ukEnglish
    6·
    11 days ago

    Strange how much higher the top one, 123456, is than the others, and how the most popular ones with repeating numbers also have 6 digits. Why do people like 6 digits so much more than 5 or 7?

    • emb@lemmy.world
      9·
      11 days ago

      Because of composition rules. Fewer characters, much easier to brute force guess.

      So when a site tells you ‘Your password must be at least 6 characters long’, and they just want to get past it to get to the content, the number is already on their mind.