246
only one – "theworldinyourhand" – is virtually uncrackable. It is the number 173 most common password and would take centuries to guess using brute force.
Not anymore. That would get moved towards the top of the rainbow table now.
Pass phrases for the passwords you have to type by hand, automatically generated passwords for the things that can autofill from a password manager, MFA for everything that supports it.
Anything less or any password reuse is just asking for trouble.
Yeah, using a pass phrase makes it much easier to remember on top of being more secure. But users should introduce at least a bit more complexity than that example (all lower case letters isn't great). This1sComplexButMemorable! Is an easy example of how you can just make up a relevant sentence to what you're using, include a range of character types for complexity and to meet requirements, and you're good to go. Plus if you make it relevant to what you're logging into, you're less likely to be tempted to reuse the pass.
ThisIsMyMotherfuckingHotmailPassword!
Is an incredibly secure password for Hotmail. And super memorable.
Brute force also doesn't necessarily mean brute forcing each character. If the password consists of relatively few dictionary words like this, it could be brute forced in a matter of minutes (depending on computation power, hash function used etc. of course).
OTOH passphrases are so rarely used that other than a handful of common examples that would already be in a word list such as CorrectHorseBatteryStaple, it would be rather unlikely for anyone to bother even trying unless they are specifically trying to crack a specific password.
So maybe don't use a plain four word english passphrase as the admin login, but if your facebook password is ZuckerbergSucksFlaccidCock, 'tis probably fine.
ZuckerbergSucksFlaccidCock
Is that better or worse than an erect one, from an insult point of view?
48736915208 No son, you're not watching YouTube.
load more comments
(1 replies)
That's the kind of password an idiot would use on his luggage!
123456, that's the same password that I have on my luggage! Set a course for druidia and change the password on my luggage
Yes, President Scroob!
They got this data from password leaks. Crappy sites that force you to create an unnecessary account for basic usage are arguebly more often part of password leaks.
So it's not a surprise that a huge amount of leaked accounts have passwords like 123456, because that's exactly the right kind of password for a throwaway account that you'll never need again. In the best case coupled to a trashmail email account.
Username: admin
Password: admin
Username: guest
Password: guest
I am in! Oh... I do not have any access
Apparently, people creating new accounts seem to assume the word (password) in the box in light gray font is a suggestion rather than a label.
lol
No mention of descending numbers, looks like 654321 is still safe. Not that uh, I, would have any particular worry about that one, nope.
eyes dart back and forth rapidly
Just waiting for the day when they start calling out those of us who make all our passwords easy to type with one hand.
All your passwords, or only the ones for certain websites?
Funny, I thought only I did that. Looks like a boss when you login to a system with just one hand and at lightning fast speeds.
Good old ]yèî̾ÌP®åÙyJàºséí³Òò&ÚÀxÁõÝÞ/ÍÔ9~B6Æ¿Üïd`ÛÝm®@. Nobody ever guesses that.
Sorry. Your password cannot contain proper nouns like the name of Elon Musk's child.
Hunter2, still haven’t been hacked (in the past few weeks)
What hasn't sorry? I can only see *******
That's amazing, I've got the same combination in my username!
Eliska81
How is this popular?
Someone on a different site theorized that password belongs to a bot network. But I haven't seen definitive proof.
I think most of these are for accounts where people don't care if they are hacked or not.
Regardless, this should not be on the individual. The issue is with the website that allows those types of passwords to begin with. There are sites that don't allow special characters at all. Stupid.
The most infuriating thing is websites that actually limit secure passwords (e.g. "password must be between 6 and 12 characters"). Preventing longer passwords makes little sense if they're salting and hashing; and if they're storing the passwords in plain text (which is just about the only reason to limit the max length to anything less than what a person would reasonably remember), that's even worse.
There was a belief, before the advent of ubiquitous password managers, that allowing passwords to be "too long" would result in people forgetting their password more often, entering it wrong, or some combination which would increase reset requests and ultimately cause people to use worse passwords. Basically "you can't remember a 54 character random password, and you're gonna get pissed and switch to a six character predictable word".
This is now obviously a terrible line of reasoning, but it was only middling bad at the time.
Oh, i guess that makes some sort of sense - obviously I disagree with the conclusion, but I understand it - but it's beyond frustrating when you think "maybe I'll pay this bill online" and see that limit. And even if that is the reasoning for the limit, if they haven't updated their requirements in all that time, I have little faith that they're storing my sensitive information securely.
load more comments
(1 replies)
Exactly, I'm not using a real password for a site I don't care about where I have nothing to protect.
I'm using something simple that I can type with one hand.
Something important however? Good luck figuring that out.
Devs out there:
- User: test@example.com
- Pass: Password1!
Everyone knows the correct test credentials are test/test. Even then, that's only if they don't allow blank/no password.
Gotta mix it up 123456A
Whoa, holup. We can use numbers and letters‽
Hey, how did you guess the password on my luggage?
Just like every year...
Mine is 654321
Since it is the opposite sequence, it clearly must be the most secure
How tf did these guys get my password?
There was a huge adobe breach a while back and they made it into a crossword. https://zed0.co.uk/crossword/
![It was bound to happen eventually. This data theft will enable almost limitless [xkcd.com/792]-style password reuse attacks in the coming weeks. There's only one group that comes out of this looking smart: Everyone who pirated Photoshop.](https://imgs.xkcd.com/comics/encryptic.png)
No significant change from the past couple of decades, then.
Wheres the list would like to compare to the previouse ones. Is it on github?
load more comments
(1 replies)
view more: next ›
this post was submitted on 17 Nov 2023
246 points (96.6% liked)
Technology
59440 readers
3470 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS