You'll never guess what the most common passwords are. Oh, wait, yes you will

123456. admin. password. For years, the IT world has been reminding users not to rely on such predictable passwords. And yet here we are with another study finding that those sorts of quickly-guessable, universally-held-to-be-bad passwords are still the most popular ones. Tech advice website Comparitech on Thursday published …

[JimmyPage]

How many systems allow unlimited login attempts ?

Which would mitigate a lot of risk.

Come to that how many systems are there that don't implement the ISO standard for authentication ?

[Phil O'Sophical]

Re: How many systems allow unlimited login attempts ?

Limiting login attempts doesn't help when someone has broken into a system and stolen a hashed password file. You can have as many goes as you like to match the hash, and then use the result to login.

[Tom Womack]

Re: How many systems allow unlimited login attempts ?

True, but 'broken into a system and stolen a hashed password file' is quite an unusual threat model: if they've broken into the system and exfiltrated something that sensitive, which is generally protected by default much better than people protect important user files, then they've already got enough access to the system that worrying about them pretending to be users is the least of your concerns.

[Blazde]

Re: How many systems allow unlimited login attempts ?

Chain it with password reuse and think again.

[Anonymous Coward]

Re: broken into a system and stolen a hashed password file.

I notice you avoided the point about implementing the ISO standard for authentication ?

[Anonymous Coward]

Re: broken into a system and stolen a hashed password file.

No amount of ISO standards will help if the system has bugs that can be exploited, and gullible staff who fall for phishing tricks.

[Roland6]

Re: broken into a system and stolen a hashed password file.

> if the system has bugs that can be exploited, and gullible staff who fall for phishing tricks.

Both of these are a given, a viable user friendly AAA security framework needs to take account of this…

[Anonymous Coward]

Re: How many systems allow unlimited login attempts ?

My password is Hunter2.

As you can see, when I type Hunter2, you just see *******. That's because I use the latest in SHA-256 fast-hashing software built into a browser add-on that automatically detects when I type any password (including Hunter2) and turns it into *******

That's why I can type Hunter2 as many times as I like and you can't see it.

Hunter2

Hunter2

Hunter2

See?

[Blazde]

Re: How many systems allow unlimited login attempts ?

Upvote for using at least one special character

[Roland6]

Re: How many systems allow unlimited login attempts ?

And including at least one uppercase and lowercase letter.

However, to make it really secure you need to add another special character and hit the magic 8 character minimum length. Suggest something along the lines of:

Hunter2?

[Anonymous Coward]

Re: How many systems allow unlimited login attempts ?

How do you know my password? Are you a hacker? o.0

[Prst. V.Jeltz]

at least one special character

I think I'm gonna start telling users they need a backspace in the password.

Cant do any harm

[Evil Auditor]

Re: How many systems allow unlimited login attempts ?

Darn! How comes you use the same password as I?!

[Bebu sa Ware]

Re: How many systems allow unlimited login attempts ?

"as many goes as you like to match the hash "

And in parallel. :)

Sceptical manglement types are always (further) confounded when you show them the output from John the Ripper run over the local password store; more specifically their password.

Long passwords and lots of salt ;)

It's not too hard to come up with a phrase that probably doesn't occur anywhere else.

"I lost the donkey's bike." isn't likely to pop up in Shakespeare's sonnets.

I guess you need some imagination hence manglements' piss poor passwords.

[collinsl]

Re: How many systems allow unlimited login attempts ?

Whereas "Hold the newsreader's nose squarely, waiter, or friendly milk will countermand my trousers" will show up all the time in scripts from A Bit of Fry and Laurie

[Adair]

Re: How many systems allow unlimited login attempts ?

So on that basis—'someone already broken in'—the argument is that therefore 'limiting login attempts' is universally useless?

There seems likely to be a logic fault in that argument.

In reality limiting attempts, at least with a time delay before allowing another set of attempts, would certainly mitigate a whole class of break-ins, given that many logins offer no limit whatsoever, so your login bot is free to make hay, probably within seconds given the typical quality of many user's passwords.

[Filippo]

I would use very long passphrases, if not for the fact that almost all systems demand numbers, mixed case and punctuation at the very least, and some of them have a max password length.

[J P]

My preference is car number plates, once in lower case & once with the shift key down. It helps that a) I mostly work with full sized keyboards and b) am a raging petrolhead with a gift for remembering car registrations going back decades so don't need to use my current car. Also means I can leave myself a postit note with just "blue maxi" or "white 504 estate" on my monitor and it's still pretty secure.

[PB90210]

I used to used a job ref (similar in complexity to a car reg plate) for the monthly password then kept a piece of printout of it on my desk

[Anonymous Coward]

@ J P

Except not if you're reusing that password on multiple sites and just one of them gets breached.

[david 12]

Re: @ J P

Except not if you're reusing that password on multiple sites and just one of them gets breached.

Except, as we see from the popular vote above, "'broken into a system and stolen a hashed password file' is quite an unusual threat model".

[John Brown (no body)]

Re: @ J P

"Except not if you're reusing that password on multiple sites and just one of them gets breached."

The username and password can be equally important. Re-using a password on another site linked via a different email/username so there's no link between the sites means re-using a password is almost as secure as re-using an email address/username.

[J P]

Re: @ J P

...which is why there's a further element related to the website name that keeps them unique. (Is it one letter? Is it two? Are they upper or lower case; before or after the numberplate? Doesn't really matter, and the extra length makes it less likely that any of them will be picked up anyway. Only real pain is sites with max length requirements as I can easliy breach those using 7 character number plates.)

[Dwarf]

You don't tend to get many special characters and symbols on registration plates though, which means it will fail complexity requirements, or you will need some other way of adding that in and remembering it each time.

[Benegesserict Cumbersomberbatch]

... until you type the number while holding down the shift key.

[bemusedHorseman]

I too, think of number row special characters as "uppercase numbers"...

[John Brown (no body)]

Until you find your computer has defaulted back to a US keyboard :-)

[collinsl]

Or the site only accepts certain special characters, which a lot of them seem wont to do these days, and it always seems to be different as to which ones they won't accept. I don't think I can even come up with a list of ones all sites that I've seen accept!

[Like a badger]

"You don't tend to get many special characters and symbols on registration plates though, which means it will fail complexity requirements, or you will need some other way of adding that in and remembering it each time."

You've got a space or two, assuming that the password algo allows the use of spaces (it seems many don't).

[Anonymous Coward]

I also use versions with car reg numbers. Old cars I no longer have - maybe not even my own. With added characters, which may be part of the name of the original owner or the model or colour or something like that. And if a potential hacker was to work out I may be using the reg number of my late father's Ford Escort and part of his name I'd have bigger problems to worry about

[SVD_NL]

At that point just allow them to use your whole identity, they earned it!

[Sudosu]

Bumper stumpers

[Anonymous Anti-ANC South African Coward]

So hXx488gP will be good enough then?

[Ian Johnston]

Dunno if it still does, but years ago the Oxford University Computing Service rejected any password formatted like a number plate. Probably because of the number of users who drove to work on something with their putative password written on it in large, friendly letters

[Prst. V.Jeltz]

just "blue maxi"

just "blue maxi"

was it SBV813T by any chance ?

that one was my dads :)

[J P]

Re: just "blue maxi"

No, a couple of years older than that... ;-)

[Anonymous Coward]

That is the correcthorsebatterystaple response.

Mixed case is simple - the first letter will be a capital. Oh yeah, that adds zero entropy. In the same way as people adding !1 at the end is so predictable that it doesn't really add anything.

[Throg]

Amusingly (and probably predictably) correcthorsebatterystaple is now found in most password cracking dictionaries.

[Charlie Clark]

As it says in the article: the length (minimum 12) is now considered to be the main factor so a phrase is a good place to start, with proper names if you like.

[Kurgan]

Password rules make for weaker passwords

Mixed case, numbers, symbols, but cannot contain some symbols and no spaces, and must change every month?

Fine: "November2025!" is good for this month.

When will people understand that allowing for a long passphrase with spaces and NOT FORCING CHANGES is the way to have good passwords?

[The man with a spanner]

Re: Password rules make for weaker passwords

I particularly like <MyPassword#>11 for this month.

What could possibly be wrong with this?!

In effect it is as strong as MyPassword# but if you are going to force me to change password every month, not allow me a password manager on my corporate system and not allow me to right it down then I have to have some strategy for remembering it, or I will frequently resetting the password.

[The Oncoming Scorn]

Re: Password rules make for weaker passwords

Bandname, album, year of release.

Make & model of vehicle & year of manufacture.

UK railway stations.

Special characters substituting regular letters, renewal time I just change where I press the shift key as its all largely muscle memory..

[twellys]

Re: Password rules make for weaker passwords

> UK railway stations.

Ah, so Llanfair...gogogoch then?

I'll get my coat...

[Anonymous Coward]

I don't know... It worked very well for Barbarella.

[Helcat]

Re: Password rules make for weaker passwords

llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch

Or... if you're really evil...

lIanfairpwlIgwyngyIlgogerychwyrndrobwlIlIantysiliog0g0g0ch

[RMclan]

Re: Password rules make for weaker passwords

or

Ll4nf41rpwllgwyngyllg0g3rychwyrndr0bwllll4ntys1l10g0g0g0ch

[Dave559]

Re: Password rules make for weaker passwords

NO CARRIER

[Strahd Ivarius]

Re: Password rules make for weaker passwords

¿ Ll4nf41rpwllgwyngyllg0g3rychwyrndr0bwllll4ntys1l10g0g0g0ch?

[Anonymous Coward]

Re: Password rules make for weaker passwords

I've written to a few corporate overlords with a link to NCSC's advice on password expiration (the advice is don't do it). Never had a reply.

[John Brown (no body)]

Re: Password rules make for weaker passwords

I don't even remember my work account password. I never have to type it in. I just use the "password recovery" when the bi-monthly email arrives telling me I have to change. This is because they enforced a "PIN" (must be letters and number and include upper and lower case - but does NOT require special characters) If anyone gets access to my laptop, they have up to two months (assuming it's not reported stolen and wiped) to guess the less complex "PIN". Although if they manage to guess my password, I'd appreciate them dropping me a line a letting me know what it is.

[Kurgan]

Re: Password rules make for weaker passwords

This is an intelligent idea against an idiotic rule, use a strong password and increase a number in it. This is what I do with all of the sites that require a password change on a password that has not been compromised: use the same (non the same for every site, the same for each site) and increment a number in it. But still a lot of people just use the current date to generate a valid (for the rules) password and then go on changing it as I stated, using the date as the reference. This way it's easy to remember it even if it changes every week.

[sarusa]

Re: Password rules make for weaker passwords

Yeah, I came here specifically to bitch about '"The most secure passwords will be set by the users who have the strictest password requirements," the privacy advocate added.' After a certain point of ridiculousness it gets totally counterproductive. Like the job I had where everyone had minimum 12 characters, one special char, one number (so far so okay) BUT there was a max of 20 chars (why?!) AND you had to change them every 90 days. So everyone used passwords like 'sigh@thisshit1' and just incremented the final digit. And when you got to 9, you could wrap back around to 0 because MS didn't keep track of that many old passwords. Super secure there with all your requirements, guys.

[Steve Graham]

Re: Password rules make for weaker passwords

A short maximum password length is a red flag. It suggests that they are storing the password, not a hash.

[Anonymous Coward]

Re: Password rules make for weaker passwords

> A short maximum password length is a red flag.

FTFY.

[Ian Johnston]

Re: Password rules make for weaker passwords

Make the password requirements onerous, demand frequent changes and you may as well say "Write the current version on a Post-It note and stick it on your monitor".

[Arthur the cat]

Re: Password rules make for weaker passwords

Make the password requirements onerous, demand frequent changes and you may as well say "Write the current version on a Post-It note and stick it on your monitor".

I'm far more security conscious than that - I stick the Post-it note under the monitor base.

[Mike007]

Re: Password rules make for weaker passwords

The UK government has been officially telling companies not to do that forced password change crap for at least a decade, likely longer. (When I looked in to it the oldest version I came across was GCHQs cyber security guidance from a decade ago, the last version before responsibility for issuing such advice was transferred to the NCSC)

When you see an IT department that requires password changes "for security reasons", you can officially tell them they are even less competent at IT than the UK government! ;)

[Ian Johnston]

Re: Password rules make for weaker passwords

My former employers started enforcing password changes every three months, so I started with <word>1 and retired at <word>103. It was reassuring to know long in advance what my last password would be.

By the way, I typically had to enter my password between 12 and 20 times per day. That is not a good way to encourage a security mindset.

[Roland6]

Re: Password rules make for weaker passwords

>” By the way, I typically had to enter my password between 12 and 20 times per day. That is not a good way to encourage a security mindset.”

When doing financials with Quickbooks, bank, HMRC, et al. Those 12-20 time a day also included entry of codes texted to the phone. SFA can be a right pain in the arse..

[John Brown (no body)]

Re: Password rules make for weaker passwords

I have to type in my full email address as username. Then the password. Then the pop-up for the USB security fingerprint reader (laptop has one built in!!) appears where it does NOT default to the correct device and have to click on the correct device, at which point I have to enter the security device PIN (all letters, not a number) and THEN touch the USB fingerprint reader. Oh, and that password at the start of the process? Now a minium 12 chars, usual character mix, expires every 2 months and it "knows" if you use a real word as part of it and rejects it.

[Anonymous Coward]

Re: Password rules make for weaker passwords

We had a client ignore our advice and wrote their own policy with this requirement in it.

I spent years using a specific user as my go-to example of why it was a bad idea. I was honestly surprised it took 3 years for Mr Password3 Password4 (after 9 he restarted at 1) to have his account compromised.

[captain veg]

TFL

I created an account on the Transport for London web site today. It only allows letters and digits in the password, no symbols, not even punctuation.

-A.

[Graham Cobb]

Re: TFL

That's Bobby Tables' fault!

[Bebu sa Ware]

Re: TFL

>> It only allows letters and digits in the password, no symbols, not even punctuation.

>That's Bobby Tables' fault!

What are the odds the character set restriction is "enforced" with javascript ? ;)

[sarusa]

Re: TFL

Ooo, Ooo, and does it limit you to 12 characters? I love sites that do that!

Even worse are the sites that let you enter 20 characters when setting up your password and then silently throw away the last 4-12 of them. And then when you try to log in with your saved password, of course it doesn't work, so you do the 'I forgot my password' link (sigh) and then they email you the 12 chars they actually used in plaintext. Okay, haven't seen that in a while, but still run into the first kind - I just keep lowering the length till it magically works.

[MachDiamond]

Re: TFL

"and then they email you the 12 chars they actually used in plaintext."

I usually get a link to reset my password to something new without it disclosing what the old password was.

My sensitive accounts use a separate email address that I don't use for other things so if there's a ask to redo my passwords or I need or I need to reset something, I have an indication that it may be legit. I also don't use any links provided if I can log in manually by typing in the URL. I get plenty of fishing attempts for banks I don't use and often get them in waves. I don't think I've ever looked at one that didn't have several fatal flaws that let me know it's not legit.

[Roland6]

Re: TFL

>” I usually get a link to reset my password to something new without it disclosing what the old password was.”

Nor do they tend to disclose the length limitation, so you can go round in circles a few times before the penny drops…

[DCdave]

Re: TFL

I recently had to reset an account because the financial provider inisted I had forgotten the password that I have stored in KeePass. I was surprised to find that it (still) enforced exactly 8 characters, no special.

But hey, it's only money.

[Roland6]

Re: TFL

A bank I used for one client had a text only 8 digit password, however, entering this caused a code to be sent to the mobile phone I included in my application for account access. This number didn’t appear in the “my details” section and could only be changed with difficulty.

So whilst the password was weak, the use of undisclosed SFA did improve security. Obviously, lose the phone and getting back in to systems was something to be avoided…

[Charlie Clark]

Iwuvlp,inftftasdn

Sounds like a good start!

[Anonymous Coward]

You are permanently barred from entering Wales for uttering such profanity!

[John Brown (no body)]

"I would use very long passphrases, if not for the fact that almost all systems demand numbers, mixed case and punctuation at the very least, and some of them have a max password length."

...and require you change them frequently. A password manager is not always an option. And you need many different passwords for many different systems. It's all one big well cooked recipe for normal fallible humans to create easily remembered passwords.

[Anonymous Coward]

I love it when I try to set up a password for a website and they have min/max password length requirements and require at least one special character from a limited list of special characters, but they don't give you any of this information, so you have to keep trying randomly until your proposed password is finally accepted.

[jlturriff]

There don't appear to be too many of these sites, but I have run across several that restrict password length, and the number/variety of allowed special characters as well, forcing their users to provide relatively weak passwords. Even a sixteen-character password restricted to seven-bit ASCII is, IMO, way too weak.

I also wonder what those who store their password wallets in the cloud are thinking of?

[NewModelArmy]

Most Popular Password : 123456

Seriously, how difficult is it to add an extra digit, such as ; 1234567

People are so lazy nowadays.

[Anonymous Coward]

Re: Most Popular Password : 123456

Come on, everywhere requires 8 characters and punctuation: 1234567!

[EvilDrSmith]

Re: Most Popular Password : 123456

I thought the correct 8 character password was:

SnowWhiteandthe7Dwarves

[Anonymous Coward]

Re: Most Popular Password : 123456

How did you get on my wifi?

[arachnoid2]

Re: Most Popular Password : 123456

i2EA567

[Someone Else]

Re: Most Popular Password : 123456

Why not "#313233#343536"? Or maybe "\x31\x32\x33\x34\x35\x36"?

[Anonymous Coward]

Re: Most Popular Password : 123456

I have the same combination on my matched luggage!

[Sudosu]

Re: Most Popular Password : 123456

Ime goes to 11

[TimMaher]

Re: Most Popular Password : 123456

In France apparently it’s “Louvre”.

[Strahd Ivarius]

Re: Most Popular Password : 123456

Or Thales

[Anonymous Coward]

Still harping over forum passwords

Forum passwords, often enough with a "Register to read this thread!" requirement, where we the user don't want the account, wish we didn't have to create it at all, and when it *inevitably* leaks, others are harping over just-how-bad those passwords are. Glad they didn't leak my *real* passwords!

Lets face it. These password breaches mostly aren't for things that people care about. People being users or admins. Forums, single-use accounts, throw-aways, etc etc.

With the odd idiot who makes their work password 1234Five, but those are the exceptions.

Where's the breakdown of "Type system from which passwords were leaked" ? Or, "Systems having password hashing, password salting, and separate password storage from data storage"?

[Kurgan]

Re: Still harping over forum passwords

This is indeed so much true. If I have to register to do something stupid and one-time, I usually enter a throwaway email and an idiotic password. And who cares if it gets leaked.

[The man with a spanner]

Re: Still harping over forum passwords

Good for a techy user.

What proportion of normal users would even think of this let alone implement it.

Wherever possible avoid giving the user the opportunity to screw up. They will, of course, still screw up, just less frequency.

[jvf]

Re: Still harping over forum passwords

Absolutely. Aren't emails supposed to be unique? Why do forums (including this one) even need them? I just use the same password as much as possible and ignore it when google warns me my password has been exposed. I don't need to provide any financial details and little personal info so I don't care. On the OTHER hand, my financial advisor recently changed where my accounts are kept. For these occasions, I use 22 char random passwords. Well, the brain dead "writers" of this web form have it refusing my password claiming it contains illegal characters even though every one of the chars can be typed from the keyboard. So, I had to dumb down my password to complete the sign up. I will be excoriating them about this in the near future.

[David Hicklin]

Re: Still harping over forum passwords

Came to to say pretty much the same thing, these are the low hanging fruit accounts that easily get guessed - you don't get many hits for ffFgghdoioijnj338488bb9d9duy££$$b

Damm , going to have to change that one now!

[WolfFan]

Re: Still harping over forum passwords

Change one of the £s to # and one of the bs to B.

[Chris Miller]

Seems the Louvre's password was 'Louvre', except for their Thalys systems, which was 'Thalys'.

[Brave Coward]

Well, that still needed a forklift truck to be broken...

[Yet Another Anonymous coward]

So that's 2 factor authentication ?

An easy password but the keypad is out of reach

[Anonymous Coward]

Well, that still needed a forklift truck to be broken...

So it wasn't Christine de Souza then ?

[Strahd Ivarius]

Re: Well, that still needed a forklift truck to be broken...

No panther was sighted either.

[DS999]

Thanks to them

I have to change all my passwords!

I was sure no one would ever guess "Louvre", but now everyone will try it. Wait, I know, I'll use 654321! Everyone tries 123456 but no one ever tries reversing it!

[Excused Boots]

Re: Thanks to them

"Wait, I know, I'll use 654321! Everyone tries 123456 but no one ever tries reversing it!”

Absolute genius.

Oh no, hang on,.,,,,,

[Lazlo Woodbine]

Forcing regular change is counterintuitive

There's a site I use for work, they force a password change every 60 days.

If that isn't bad enough, I only use the site once a term, so I have to change the password every single time I use the website, and I cant use any previous passwords.

I imagine most people just type something random into the password box, then use the forgotten password routine when they log in again 120 days later...

[gnasher729]

Re: Forcing regular change is counterintuitive

I left one company, with my current password set to <highlycomplexpassword>37. Guess how long I worked there.

But then, I usually use Safari generated passwords for websites. One turned out was used in a breach. So I know one company that most definitely stored my password as clear text.

[Anonymous Coward]

Re: Forcing regular change is counterintuitive

Or they used reversable encryption, along side the encryption key. While they might have been idiots, they might simply have been stupid.

[Excused Boots]

Re: Forcing regular change is counterintuitive

Would it be somewhere between 36 and 37 months?

[WolfFan]

Re: Forcing regular change is counterintuitive

heh. One site I go to quite often requires a new password every 3 months and has strict requirements. So my password there is <five characters, one of them a capital><symbol><two numbers><four characters, one of them a capital>. That's the required 12 character limit, with a symbol, at least one capital, and at least two numbers. The two numbers start at 00 and advance one digit per password reset to 09. I then change the symbol and start the numbers over at 00. The five and the four characters have not changed in over a decade. The email address associated with the site is a @outlook.com throwaway which I generated specifically for this site and which is used only there; the idiots also insist on webmail, so that particular email is monitored only by their webmail. The only mail I get there is from them... and spam. Lots and lots and lots of spam, almost as if someone other than myself and those idiots (and Microsoft, of course) had access to a strangely formatted email address used nowhere else.

[ComputerSays_noAbsolutelyNo]

Re: Forcing regular change is counterintuitive

Well, isn't using the "I forgot my password" route a sort of two-factor authentication?

One and a half factor, perhaps?

[MachDiamond]

Re: Forcing regular change is counterintuitive

"There's a site I use for work, they force a password change every 60 days."

I don't see any usefulness in that. It encourages users to create simple passwords they can remember and/or write them down and store them someplace handy that isn't too hard to find. Are they worried about a brute force attack? Who's to say that if that's the case, the new password you create isn't immediately found. It sounds more like a lack of security on the server end. I also have a couple of sites that require me to create a new password ever so many days which is about how often I use them. I have to keep updating my password file that has a password I haven't changed in ages so when I get hit by a bus, a family member can retrieve the envelope with that password in it and access my accounts. Most of them, anyway. That's a reason I don't go for biometric authentication. There may be no way to get that element once I'm gone.

[Lazlo Woodbine]

Re: Forcing regular change is counterintuitive

That's kind of my point...

[David Hicklin]

Re: Forcing regular change is counterintuitive

> It encourages users to create simple passwords they can remember and/or write them down and store them someplace handy

I had that as well , used a combination of postcodes and car number plate numbers . they were actually 1 character short (7 mostly in the UK and I needed 16) so a number or $ got added to pad them out

[Terry 6]

Re: Forcing regular change is counterintuitive

Even better a local authority that insisted staff change passwords every 30 days.

Which meant that a) busy school staff just used to increment a password, often something easy to recall and type, Like Year3AcornClass1..Year3AcornClass2...etc.

B) At the start of each term there'd be queues of staff all calling central IT to get the expired PWs reset from most of the teachers and TAs in most of the primary schools.

C)Not having time to faff about while the kids are coming in if the password wasn't an easy one ( and sometimes even if it was) they'd have a PostIt note near the keyboard and would cross out the number at the end and replace it with the next digit when it expired.

[Antron Argaiv]

Re: Forcing regular change is counterintuitive

<password>MMYY was my go to at work.

[IamAProton]

Password fatigue

every **** thing requires logins and complicated passwords and password managers do not really help becasue, if you don't have the password manager handy, you are out of luck.

I have mixed feelings for 2FA with OTP that require an internet connection with the phone.

Sometimes theoretial higher security turns into actual lower security. Force me to write a long passphrase and let me be, the requirement for symbols, numbers etc. is often the reason users picks asdfgh123! as a secure password.

[Anonymous Coward]

Re: Password fatigue

So, I run my own password manager, its a commercial one, and its the free version. I also modified the tomcat configuration to require a client certificate. This means you can't actually connect to it, and I can reach it from anywhere.

[MachDiamond]

Re: Password fatigue

"if you don't have the password manager handy, you are out of luck."

I've had that happen when away from home with a new laptop. The password manager application wanted payment for each computer it was installed on (I found something else). Having the password manager on the laptop might also be a liability if that gets hacked. Laptops are more often nicked than desktops. My main production Mac Pro is a frickin' boat anchor so I'm not so sure that a burglar is going to want to get it out of the house in the little time they have with the alarm going off and a strobe light blinking away on the roof.

[Bebu sa Ware]

Re: Password fatigue

"I have mixed feelings for 2FA with OTP that require an internet connection with the phone."

Pissed me off that TOTP doesn't require an internet connection if the seed is stored on the authenticator but most 2FA providers don't make the seed available or allow you (personally or as an admin) generate your own.

Although I had to laugh when one mob used a qcode to upload the seed etc to their authenticator app. It was purely a plaintext totp:// url, including the seed.

[Anonymous Coward]

a random character

"icantbelievewerestilltellingyouthis,"

"icantbelivewerestilltellingy0uthis,"

which of the two changes were you referring to?

[KittenHuffer]

Re: a random character

"icantbelieveitsnotbutter" - We were told that this password was discussed in the Australian parliament!

--------> Mine's the one covered in a suspiciously yellow, slippery substance!

[segfault188]

Re: a random character

"icantbelieveitsnotbutter" - We were told that this password was discussed in the Australian parliament!

The lady who revealed this was called Marge.

[Yet Another Hierachial Anonynmous Coward]

Re: a random character

Marge?

Are you sure she wasn't Flora?

[RT Harrison]

Re: a random character

~#@❯ python .\pwned.py icantbelieveitsnotbutter

icantbelieveitsnotbutter was found with 89 occurrences (hash: 28F02358C089B6CD46CA7C6AF3BF8A950345ABEF)

[John69]

Where are they getting the passwords from?

They say "Comparitech researchers aggregated more than 2 billion real account passwords leaked on data breach forums in 2025". Surely this means that large numbers of systems are still storing passwords in plain text rather that salted/peppered hashes? Is that not the news story, rather than "people are using weak passwords"?

[Hawkeye Pierce]

Re: Where are they getting the passwords from?

Stealer logs.... malware running on computers capturing the passwords as they were typed.

See https://www.troyhunt.com/2-billion-email-addresses-were-exposed-and-we-indexed-them-all-in-have-i-been-pwned/ for some details.

[doublelayer]

Re: Where are they getting the passwords from?

Some of those will be cleartext or unsalted hashes, both of which make frequency analysis easier. Others will be salted hashes which they tried some old favorites against to make sure they're still in use. Unfortunately, good password storage is another thing that we've known how to do for some time and yet we will probably never see the end of yet another system storing them badly.

[Bill Gray]

Re: Where are they getting the passwords from?

When a site tells me the password has an upper limit on length and that certain characters can't be used, I assume the password is stored in plain text. (Why else would you apply such limits?)

Such limitations are common enough to suggest that a substantial number of sites (including, $DEITY help up, my mother's bank!) don't salt and hash passwords. Or even just hash them.

[Bebu sa Ware]

Re: Where are they getting the passwords from?

"my mother's former bank!"

I would hope. Cluelessness tends to be organisationally pervasive.

[sroens]

Re: Where are they getting the passwords from?

Re. Surely this means that large numbers of systems are still storing passwords in plain text rather that salted/peppered hashes?

I was recently to a seminar with a PEN tester, he told that first attack was to export a backup of the password file and then brute force the hashes.

I wondered how this could work with salted password, which I believed has been standard for the last 25+ years.

Reason:

Default setting for Microsoft AD is to not use salt.

https://learn.microsoft.com/en-us/answers/questions/1726174/windows-passwords-salting

[Roland6]

Re: Where are they getting the passwords from?

> Default setting for Microsoft AD is to not use salt.

Probably also the default setting for Azure, 365, Entra ID (formerly Azure AD)…

[Jou (Mxyzptlk)]

Re: Where are they getting the passwords from?

> Default setting for Microsoft AD is to not use salt.

This information is WRONG. The article you link to does not represent reality.

In AD with kerberos, the default is RC4_HMAC_MD5, simply because that was the most compatible highest in kerberos when AD got implemented, and still supported since kerberos documentation says so. No NTLM of any kind is stored in AD.

As for local password: NTLMv2 hash is salted, especially during password transmission for authentication. used since at least Windows NT, but then again: Since Windows 2000 there is a push from Microsoft to set "NoLMHash" via GPO or registry.

Why this is not killed yet: Compatibility. I had even recently CISCO Software appliances which use and SMB2 authentication with NTLM v0.12 like in this article, which is Windows NT 3 level. They fell apart when I enforced NTLMv2 as lowest.

My real gripe with AD is: By default DES has is allowed when requestes, even on a fresh Server 2025 AD. And NETAPP CIFS, yes that company, uses by default DES for its computer account and always shows up in "who the fuck uses old hashes?" audits. You have to manually-shell-configure it to use AES256, which works since Windows Vista...

Agh, you made me rage-wall-of-text again. As much as I like bashing on Microsoft, and they deserve it right now: Even people like that "Ganeshkumar" are wrong, or at least heavily misleading. Just look at "Microsoft Licensing", which even Microsoft does not understand....

[[e-mail]]

Re: Where are they getting the passwords from?

Another reason to limit password length is to prevent buffer overflow attacks. Some system let you in with any string over xx charecters.

[Bill Gray]

Re: Where are they getting the passwords from?

True. Yet another reason I've seen promoted : sending a gigabyte-long password could conceivably be a denial-of-service attack. (Kinda farfetched, I'd think, but some security-conscious folk do consider farfetched scenarios.)

However, either of these concerns would cause most of us to set 'xx' to be, say, 256 characters. Setting it as low as xx=20 suggests a database where the password has to be twenty bytes or less in size.

[Fruit and Nutcase]

India@123

India all out for 123 against England.

England@789

[James O'Shea]

Re: India@123

England beating India? That never happens.

[Anonymous Coward]

Re: India@123

That's why it's such an unguessable password...

[Anonymous Coward]

Re: India@123

I had taken that was from M&S, Coop or JLR and was a default TCS password.

[wub]

What about username?

Why can't more sites allow logins with non-email usernames? Yes, folks get frustrated by name collisions (I sure do), but my email address is far from secret. About the only place I get to make my username is at financial sites. And I make my usernames as obscure as allowed when given the chance.

I figure it can't hurt to use as many pieces of furniture as I can to block the door.

[GlenP]

Re: What about username?

Seconded, even worse I've got one where I ended up having to set up a second email address for myself just to log in to a support site.

We have an ERP system for one group company, no problem with my main email address for the support site.

We then implemented the same ERP at another group company but with the financials from the same provider. For no reason I could see they couldn't add the financials package onto my original support account so I had no choice but to set up a new one, and it has to be a live email address. It suited me slightly to keep things separate so easy enough to set up a group mailbox but I can see that in a larger environment it might have caused problems.

So now I have to log in to the support with the correct email address depending which company I'm dealing with at the time.

[KittenHuffer]

Re: What about username?

Even more annoying are the sites that require an email for the username ..... and then tell me that I have not entered a valid email address! The most annoying being my local council.

I have a domain in the .email TLD, and generate a unique email address for each site that I login to. That way if I start getting spammed I know who lost or handed out the email address.

But I occasionally run across sites that say that <yourcompany>@<mydomain>.email is not a valid email address. Only one of which has actually responded when I sent them a message about the problem.

[ThatOne]

Re: What about username?

Your council is probably only accepting the classic TLDs (.com, .net, .org)?

[Roland6]

Re: What about username?

It is surprising how many sites treat short email addresses as invalid, my email address is of the form: [e-mail] - I’ve had it since the 1980s…

[Graham 32]

Re: What about username?

> <yourcompany>@<mydomain>.email is not a valid email address.

I lost my oracle forum account to that. They did some update and from then on when I tried to log in it would tell me staff have to use their intranet site to access the forums.

[doublelayer]

Re: What about username?

The username is going to be stored in cleartext because they use that to identify you. If you want to have more random data, stick it onto your password to make it longer*, because that's the part that gets hashed if they're doing it correctly. Admittedly, I do kind of do this by using separate emails for different sites, but that's for spam detection and prevention, not account security.

* If they have a maximum password length, then you have a bit better of an argument and a reason to worry about what they're doing with the password you give them.

[Filippo]

Re: What about username?

Well, the username isn't supposed to be that secret either - but I would still like sites to stop using email as username, simply for the fact that emails are not forever. What happens if I change email provider and lose access to that email? Yes, yes, have your own domain, I know, but the vast majority of people won't do that.

[Roland6]

Re: What about username?

Only a few sites seem to have realised it is perhaps not a good idea to have the same email address for the user name and the password reset/recovery.

The problem I have with some major sites is that they don’t handle the idea that the same recovery email address/phone can be used across multiple accounts…

[Terry 6]

Re: What about username?

Then there's Virgin Media which first started to requires a second email address that's not your VM one as the 2FA, but then decided to make that the username instead of the actual account address.

So I had to remember that to log in to My.chosen.name@vigin media.co.uk I had to type [e-mail]

Then on some of our family addresses, but not,strangely, all they decided that the 2FA address couldn't be the user name either- and I had to supply a third address to log in with.

It got so confusing that I pretty much gave up using them at all - which may be exactly what he were aiming for.

[Kubla Cant]

Re: What about username?

Security through obscurity. Proverbially reliable.

[David Hicklin]

Re: What about username?

I have my own email domain and can use <anything>@<my domain>, so for any company I deal with I use <company name>@<my domain>

Had one or two confused sounding people when doing something over the phone !

Along with unique passwords (thank you keepass) if I get any spam on one of those addresses I know who it is immediately (unless of course they are trying to frame a rival co)

[anonymous cat herder]

Re: What about username?

I've been doing this for years. It is also amusing to discover links between company brands when they share the email address internally.

To finesse the scheme I also use a prefix to determine which mailbox should receive it, so a.<company>@<domain> and b.<company>@<domain> are different mailboxes.

[Aladdin Sane]

123456

That's amazing. I've got the same combination on my luggage.

[ParlezVousFranglais]

Re: 123456

Hail Skroob!

[Jou (Mxyzptlk)]

Re: 123456

So you upgraded to be more secure! Mine is still 12345!

[David Hicklin]

Re: 123456

For hard suitcases they don't even need that, just drop it hard on one corner can be enough to pop some open (OK that info is from the 1980's but somehow I suspect that they have not improved that much)

[teebie]

These are the most commonly leaked passwords, not the most common passwords.

A strong password that was users as often as 12345678 wouldn't make the list, because it is leaked less often.

[Aladdin Sane]

Doesn't matter how strong the password is if the database it's stored in gets hacks.

TL;DR, you're wrong.

[teebie]

It does if the passwords in the database are hashed.

[Jou (Mxyzptlk)]

IF they are hashed, and salted, and HMAC-ed so that the same password does not result the same hash. "Pure" hashes are out since Windows NT 4.0 (unless a client specifically asks for lower PW-encryption, which is still possible in the default fresh Server 2025 AD: Usage of DES, if specifically requested, is still not blocked by default)

[Decay]

I like the sites that review your password and refuse to accept it because it is too simple, wouldn't take much effort to add a database of top 500 common passwords and blacklist them. I get peeved when a site wont let my password manager use a 16 character password that contains uppercase lowercase numerical and special characters and then I have to tell the password manager to dumb it down.

Yes my password manager password is a lonnnggggg passphrase but its muscle memory now and I change it every so often.

[David Hicklin]

> Yes my password manager password is a lonnnggggg passphrase but its muscle memory now and I change it every so often.

depending on where you store it, if they have access to try passwords against it, then that could be the least of your problems.

Mine is fairly simple and easy to remember but then again is on my local NAS, if someone is trying to hack that then my entire home network is compromised.

[mhoulden]

"Correct horse battery staple" and variations don't appear in Comparitech's top 100 but they're common enough that they're best avoided.

One of my gripes is that a lot of sites encourage people to register so they can capture personal information and ultimately use it for advertising. Some news sites (present company excepted) are particularly bad for this. Being able to track demographics and page views down to an individual level might be nice to have for the ad tech industry but it can have consequences if it makes people use insecure passwords or could be stolen.

[Dr Dan Holdsworth]

Avoid plain biometrics

In the Sci-Fi novel "One of us" the point is made that a plain biometric for a passcode is a very, very bad idea. The book plot starts with a small-time criminal suddenly discovering that his bank account is empty and he is effectively penniless. He asks a local fence for a loan, and instead receives a finger.

This is the severed finger of someone with no family and few friends, detached from its original (sadly deceased) owner and attached to a small life support device. Quick, untraceable money for as long as the owner's death remains undiscovered because in this book banks are stupid and allow pure biometric ID.

[Anonymous Coward]

Re: Avoid plain biometrics

Exactly. Biometrics can be used in place of a Username, but never as a Password.

[dmesg]

Re: Avoid plain biometrics

Not to mention, in some situations in some jurisdictions (in the US at least), you cannot legally refuse to unlock a device secured with biometrics, but you are within your rights to refuse to disclose a password or PIN.

[Greybearded old scrote]

Re: Avoid plain biometrics

Don't even need a finger, when you leave your password on every damn thing you touch.

[Anonymous Coward]

Re: Avoid plain biometrics

We should avoid biometrics like the plague. It's another tool in the creation of feudalism 2.0. With biometrics you can catalogue people & prevent anonymity. I am not breaking the law (yet) but allowing governments the capability we have now is a very dangerous thing. Even if you are happy with your government ( I am not ), you may not be with the next one and eventually one will stop listening to what you want and do what they want. Personally, I feel we are there now, they are just not going full draconian as they haven't completed the control grid yet. It's cut by tiny cut so the people don't get uppity until too late. Also, with so many laws and never repeals, you will always be breaking one which lets's the authorities apply punishment based on their view of you.

[Rich 2]

xkcd

According to this (and I have no idea of it’s correct) we’re all doing it wrong

https://xkcd.com/936/

[David Hicklin]

Re: xkcd

That's where we have all got it wrong.

Everyone is using "HorseBatteryStaple" when we should be using "CorrectHorseBatteryStaple"

[Potemkine!]

Re: xkcd

This is soooooo true.

Make long passwords easy to remember, not gibberish ones which are impossible to remember.

And use keepass.

[Primus Secundus Tertius]

Not bothered

I sometimes use 'drowssap' against the more tiresome websites.

[Anonymous Anti-ANC South African Coward]

Re: Not bothered

Ahhh, the good old drowssap. Nobody'll ever guess that one, will they?

[NapTime ForTruth]

Re: Not bothered

And if they do guess it, you'll know they're from some terribly backward country.

[JimmyPage]

what about the MFA aspect ?

It's less of an issue about your password it your systems use additional mechanisms to authenticate you.

Plus a lot of systems *should* ring fence really sensitive commands with a repeated prompt for an MFA token.

Yes it does add a bit to the clunkiness. However you have to decide how far you are willing to sacrifice security for simplicity.

[Anonymous Coward]

Re: what about the MFA aspect ?

> you have to decide how far you are willing to sacrifice security for simplicity.

For most people, the answer sadly is "totally". That's why they also leave their door key "hidden" under a flower pot.

[Anonymous Coward]

Re: leave their door key "hidden"

I have known a few people who leave their cars unlocked (with nothing inside them).

Because the only thing worse that have £1,000 damage done to nick £1,000 worth of stuff, is to have £1,000 of damage done to find fuck all.

I wonder how many of the passwords covered in the article were setup as a honeypot ?

[doublelayer]

Re: leave their door key "hidden"

"I wonder how many of the passwords covered in the article were setup as a honeypot ?"

Given that the point of a honeypot is to know when someone got in and what they did, that would be none of them. Honeypots are a little more complex than having a bad password on someone else's site. In addition to being useless, deliberately trying to do that is likely a terms of service violation on that site.

[Jou (Mxyzptlk)]

Re: leave their door key "hidden"

Whether you call it "Honeypot" or "Phishing", both do the same job. The difference is the interpretation or what those, who capture the logins, do with those.

[Anonymous Coward]

Re: leave their door key "hidden"

You may find someone sleeping in your car and asserting squatter's rights! :-o

Or worse using it as a toilet.

[NapTime ForTruth]

Re: leave their door key "hidden"

By some standards those two are the same thing, effectively using the username as both the username and the password.

For convenience, obviously.

[MachDiamond]

Re: what about the MFA aspect ?

"However you have to decide how far you are willing to sacrifice security for simplicity."

The average punter will opt for simplicity every time. One-Click purchases anybody?

Call the pizza joint and your caller ID is your account. Just schedule for pickup instead of delivery.

[MachDiamond]

Re: what about the MFA aspect ?

"Plus a lot of systems *should* ring fence really sensitive commands with a repeated prompt for an MFA token."

Some do and what they consider "sensitive" isn't the same as my opinion so I just copy/paste the info over and over to do something simple such as check a balance or when the book is due (or I want to extend) at the library.

[Richard 12]

That was two factor though

The second factor was "sounding like Captain Janeway", as the computer canonically uses voice identification.

Quite why they used that when they already knew of several individuals capable of perfectly mimicking a voice is unclear though.

[Anonymous Coward]

Re: That was two factor though

Still running Windows 10 perhaps ?

[Anonymous Coward]

Is that password or authorisation phrase ??

Shirley she’s already signed in.

The dark side of me does think however a password reset, failed captcha, late SMS MFA, Microsoft Authenticator/EntraID or (like at the supermarket checkout) your “App” logs you out and you can’t log back in will cause the end of the world trying to stop some missiles being launched, stop the Auto Destruct of Voyager or something.

Best left for Black Mirror to work that one up.

[sabroni]

re: this problem will linger long into the future.

You know Start Trek is fiction, right?

[WolfFan]

Re: re: this problem will linger long into the future.

It is? But Data seemed so real! He behaves just like one of the sysadmins!

[PhilipN]

What's Eric Schmidt's Favourite Password?

You know, the "“If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place” Eric Schmidt.

Plonker.

[Anonymous Coward]

Re: What's Eric Schmidt's Favourite Password?

Or Elon Misk.

“OneTreeelllliiiiiiiiiioooonn”

[BasicReality]

I use a random password generator, typically go about 40 characters, I hate it when I go to sites that limit the length. Signed up somewhere recently that had a 15 character limit, ridiculous.

[Dwarf]

Invalid

Its much easier to remember if you just set you password to "Invalid", then if you type something wrong, the computer will simply say "your password is invalid" and off you go.

[Kubla Cant]

Re: Invalid

On a similar basis I log in to quite a few trivial sites with the username "required", because it told me when I created the account that "Username is required".

[David Hicklin]

Re: Invalid

> few trivial sites with the username "required", because it told me when I created the account that "Username is required".

I could never work our why the user name was taken, now I know who their one and only customer is!

[Ken Shabby]

Re: Invalid

Password needs to be unique.

This password is taken by the user

[e-mail].

Please choose a different password.

[Roland6]

Re: Invalid

Surely that is:

Taken by the user [e-mail]

ie. Your own email address, because you didn’t realised some other website, on which you have an account, is connected and thus uses the same credentials to the one you are trying to access…

[hedgie]

I've been using a shell script that takes one parameter like the site name, and a master password, sticks 'em together with some other stuff (fixed) added in, then generates a password of whatever length I need after running it through a hash. Only problem is the arbitrary "must have 1 uppercase letter, 1 lowercase letter" and so-on requirements. The generated password doesn't always follow those, so I have to try something else, and that's where I'd run the risk (for something trivial) of using a shite password, or just having to reset it every time I'm using something that doesn't have it stored already.

Personally, I'd want to use GPG key pairs, like I do for ssh access to my boxen, but then the weak link would be revocation and adding new keys. Even my bank uses plain email and SMS for resets.

[Anonymous Coward]

Or you could improve your script?

[NapTime ForTruth]

Easy, tiger! Let's not go turning work into work.

[Bill Gray]

We seem to be thinking along similar lines. I got most of the way toward approximately the same goal :

https://www.projectpluto.com/pw_hash/pw_hash.htm

The idea is that you type in your master password, and it's combined with various salts for various sites/passwords and put through SHA256. There's a bit of logic in there for uppercase-only, number-only, "must have at least one special and/or one number", etc. cases.

The overall concept, I think, is sound. The hashing, etc. takes place within your browser; no data is transferred over the Interwebs. As noted at the above link, there are limitations. It'll handle most of the "special character" requirements, but not some of the odder ones that some sites have. (I'm not much of a Javascript programmer.)

I also did some work on the same idea, but in C, where I actually know what I'm doing. I still like the overall idea of a browser-based solution, though.

[hedgie]

Definitely, a browser-based solution means that you just need a network connection if you're needing to access something while not on a device you can run a script/program on. And one could definitely insert things like special characters at a position based upon the number of characters in the master password. Sure if it's a javascript thing online, an attacker could know whatever pattern you have for generating that sort of stuff, but if it's not a site/service a lot of people are using, it probably doesn't matter. If someone is specifically after *you*, you've probably got bigger problems to worry about. Any generator just needs to be "good enough" for most things, since most attackers are going to just go for the low-hanging fruit on whatever easy targets they can find.

[Tim99]

Netware

Back in the day, some standard Novell 68/86/2 systems expected a complex password changed every 40 days (Biblical?). Our users, like many others, solved that problem with Post-it notes on the screen. After they were told to stop it, they adapted by putting the Post-it under the keyboard...

[Anonymous Coward]

Re: Netware

Ah the good old days when you only needed 2 passwords; one for work and one for personal. When I finally exited that approach I had to change 250 passwords, groan. So now I have a vulnerability managing 250 passwords. A hardware key is my preference but I dread that failing or getting lost. Biometrics are ok provided you have absolute certainty only a hash of them leaves your possession. But you still have the problem biometrics change. Bit of tough DIY or garden work and you can't get in the phone easily!

[frankyunderwood123]

trumpisacunt

oh no! I just gave my password away!

[Always Right Mostly]

"No matter who you ask, the most important factor is length. "

This is debateable. Many women say girth matters more.

[John Brown (no body)]

Is that the ones who have a lightbulb moment?

[Anonymous Anti-ANC South African Coward]

Whopping good chips and fries...

And the Whopper had a whopping good security system too...

...granted, you gotta dial the correct number first though.

The issue with security will be with us for a long time, no matter what you do, because ne'er-do-wells will think outside the box.

[Big_Boomer]

It's a random Friday in November,.... it's The Register's Passwords Article Day 2025.

People are, have always been, will always be terrible with passwords. That is because the idea of passwords itself is flawed and insecure. 2FA is better but is clunky and difficult to use. No, I don't have any ideas on how to identify people in a more secure and easy to use way, but a good start would be for such identification to only be required for very few websites and applications. As it is every TomDick&Harry website requires identification so that they can spam the crap out of you with marketing garbage.

[Jonathan Richards 1]

"ican'tbelievewe'restilltellingyouthis"

Non-alphabetic character: check √

Proper punctuation (reducing nervous tic during login): check √

[David Hicklin]

and it promptly get stored as icantbelievewe

at the last job we had an application that I had automated the hell out of the installation by writing a script for it, it would even set up the account the service used (this was windows server world) which worked fine except some genius in the past had used punctuation in the password and it would have been a real pain to change it.

For those edge cases the instructions (yes I even wrote a guide on how to use the thing!) were "use anything you like" and change the password manually before starting the app or you would lock the account very quickly.

[Anonymous Coward]

Not so stupid

It doesn't help that so many sites require passwords for absolutely trivial purpose, mostly to claim data they collected, which they don't need for the function of their business, is protected shortly before they lose it to a hacker. Which upsets them because they think they should own the value of the data. Sites that really do need security, most people are happy to be sensible.

Businesses may be another matter when there is a reason for security but half the workers don't care.

For 80% of cases the email or sms with passcode and a link to click is easy and convenient.

[CorwinX]

For quite a while...

... one of my admin passwords was 1qazxsw2 - down and back up the two leftmost banks of keys.

Don't know how guessable that is but quick to do one handed.

That one's retired now so not revealing anything anyone could use.

I also have a standard password I use for anthing, like news sites, that require logon but don't have any security/financial risk.

The likes of eBay, Amazon etc have specific complex passwords.

[Prst. V.Jeltz]

IMPOSSIBLE pwd rules

I worked at a place that provided I.T. for a bunch of smallish companies , I worked on the help desk .

My superiors and betters in the server department had managed to arrange a password policy that was IMPOSSIBLE to satisfy .

This took quite some proving - the fact I was getting many calls a day from people failing to set passwords and me doing it for them didnt seem to ring any alarm bells .

They were also very vague on what rules they claimed to have set ( something I've seem from server boys everywhere Ive worked )

I had to learn how to interrogate AD , look at policys etc until I unearthed what they had set up , which was something like

minimum 15

maximum 10

and even then it wasnt immediately addressed

[Potemkine!]

Another mandatory XKCD

The best way to break passwords

[speed]

A lot of this data appears to be over 10 years old (https://www.troyhunt.com/2-billion-email-addresses-were-exposed-and-we-indexed-them-all-in-have-i-been-pwned/)

[M.V. Lipvig]

Funny, that

I work for a global telecom and quite a lot of our equipment uses admin/password for administrative access to the machine. Supposedly it's all safe behind the VPN.

My own password is LiberalsLoveTrump#1. The criminals might be able to guess it, but being criminals they'll never be able to make themselves type it.

[david1024]

Wonder

How many of these passwords were for throwaway accounts that users were not routinely using?

I know I don't put much thought or care into a throwaway account password, and I bet bots and click farms don't either. And I have way more of those throwaway accounts laying in my digital wake than ones I really use... So how reliable is this approach of using compromised accounts? Still fun, but I don't think the data tells the same story today it would have a decade or two ago.