{"id":131237,"date":"2024-06-15T09:37:41","date_gmt":"2024-06-15T13:37:41","guid":{"rendered":"https:\/\/rbach.net\/?p=131237"},"modified":"2024-06-15T09:37:41","modified_gmt":"2024-06-15T13:37:41","slug":"why-are-we-still-using-bad-passwords","status":"publish","type":"post","link":"https:\/\/rbach.net\/index.php\/why-are-we-still-using-bad-passwords\/","title":{"rendered":"Why Are We Still Using Bad Passwords"},"content":{"rendered":"\r\n

\"Why<\/a>Why Are We Still Using Bad Passwords? 123456<\/strong> is the worst password<\/strong> of 2023. Users have chosen 123456 on more than 23 million breached accounts<\/a>, even though it takes less than a second to crack. NordPass<\/a>, the sponsor of the paper<\/a>, claims that the popularity of 123456 has made it the #1 cracked password for 3 of the last 5 years. In 2019, 12345 from “Spaceballs<\/a>” overtook it, and \u201cpassword\u201d did the same in 2022.<\/p>\r\n

\"Stop<\/a>Only 2 of 2023\u2019s top 25 passwords will resist an attacker<\/strong> for more than 10 seconds. The 17th most common password, \u201cadmin123\u201d, can withstand cracking attempts for a whole 11 seconds<\/strong>. The most secure password in the top 25, \u201cPass@123\u201d, can fend off an attack for 5 minutes<\/strong>.<\/p>\r\n\n\n\n\n\t\n\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t

NordPass 25 worst passwords 2019 - 2023<\/strong><\/center><\/h3><\/th>\n<\/tr>\n<\/thead>\n

<\/td>2019<\/strong><\/td>2020<\/strong><\/td>2021<\/strong><\/td>2022<\/strong><\/td>2023<\/strong><\/td>\n<\/tr>\n
01<\/td>12345<\/td>123456<\/td>123456<\/td>password<\/td>123456<\/td>\n<\/tr>\n
02<\/td>123456<\/td>123456789<\/td>123456789<\/td>123456<\/td>admin<\/td>\n<\/tr>\n
03<\/td>123456789<\/td>picture1<\/td>12345<\/td>123456789<\/td>12345678<\/td>\n<\/tr>\n
04<\/td>test1<\/td>password<\/td>qwerty<\/td>guest<\/td>123456789<\/td>\n<\/tr>\n
05<\/td>password<\/td>12345678<\/td>password<\/td>qwerty<\/td>1234<\/td>\n<\/tr>\n
06<\/td>12345678<\/td>111111<\/td>12345678<\/td>12345678<\/td>12345<\/td>\n<\/tr>\n
07<\/td>zinch<\/td>123123<\/td>111111<\/td>111111<\/td>password<\/td>\n<\/tr>\n
08<\/td>g_czechout<\/td>12345<\/td>123123<\/td>12345<\/td>123<\/td>\n<\/tr>\n
09<\/td>adst<\/td>1234567890<\/td>1234567890<\/td>col123456<\/td>Aa12345<\/td>\n<\/tr>\n
10<\/td>qwerty<\/td>senha<\/td>1234567<\/td>123123<\/td>1234567890<\/td>\n<\/tr>\n
11<\/td>1234567890<\/td>1234567<\/td>qwerty123<\/td>1234567<\/td>1234567<\/td>\n<\/tr>\n
12<\/td>1234567<\/td>qwerty<\/td>000000<\/td>1234<\/td>123123<\/td>\n<\/tr>\n
13<\/td>Aa123456.<\/td>abc123<\/td>1q2w3e<\/td>1234567890<\/td>111111<\/td>\n<\/tr>\n
14<\/td>iloveyou<\/td>Million2<\/td>aa12345678<\/td>000000<\/td>Password<\/td>\n<\/tr>\n
15<\/td>1234<\/td>000000<\/td>abc123<\/td>555555<\/td>12345678910<\/td>\n<\/tr>\n
16<\/td>abc123<\/td>1234<\/td>password1<\/td>666666<\/td>000000<\/td>\n<\/tr>\n
17<\/td>111111<\/td>iloveyou<\/td>1234<\/td>123321<\/td>admin123<\/td>\n<\/tr>\n
18<\/td>123123<\/td>aaron431<\/td>qwertyuiop<\/td>654321<\/td>1111<\/td>\n<\/tr>\n
19<\/td>dubsmash<\/td>password1<\/td>123321<\/td>7777777<\/td>'P@ssw0rd<\/td>\n<\/tr>\n
20<\/td>test1<\/td>qqww1122<\/td>password123<\/td>123<\/td>root<\/td>\n<\/tr>\n
21<\/td>princess<\/td>123<\/td>1q2w3e4r5t<\/td>D1lakiss<\/td>654321<\/td>\n<\/tr>\n
22<\/td>qwertyuiop<\/td>ompop<\/td>iloveyou<\/td>777777<\/td>qwerty<\/td>\n<\/tr>\n
23<\/td>sunshine<\/td>123321<\/td>654321<\/td>110jp110jp<\/td>'Pass@123<\/td>\n<\/tr>\n
24<\/td>BvtTest123<\/td>654321<\/td>666666<\/td>1111<\/td>112233<\/td>\n<\/tr>\n
25<\/td>11111<\/td>qwertyuiop<\/td>987654321<\/td>987654321<\/td>102030<\/td>\n<\/tr>\n
Nordpass<\/a><\/td><\/td><\/td><\/td><\/td><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\r\n

How can I keep my passwords safe?<\/span><\/h2>\r\n
Your password should have at least 12 characters <\/span><\/h5>\r\n

\"Your<\/a>A longer password<\/strong> with more characters is better. It gives a hacker more combinations to try. Some sites may require a certain number of characters in your password, but generally, a password with at least 12 characters is a safe bet.<\/p>\r\n

Use numbers, symbols, uppercase and lowercase letters<\/span><\/h5>\r\n

The more variety you have, the better. Be sure to include numbers, symbols, capital, and lowercase letters<\/strong>. Make everything as random as possible to keep the hackers out. For example, a password like \u2018S#w%i&n(g967\u2019 would be much more difficult to crack than \u2018swing967.\u2019<\/p>\r\n

\r\n
\r\n
Avoid dictionary words<\/span><\/h5>\r\n<\/div>\r\n<\/div>\r\n

\"Avoid<\/a>Avoid using any single word as a password. It\u2019s too easy for a hacker to take one lucky guess from a common dictionary, like \u2018dog\u2019 or \u2018banana.\u2019 Even a password like \u2018freeride\u2019, which combines two dictionary words, is too simple.<\/p>\r\n

Don\u2019t use substitutions<\/span><\/h5>\r\n

Avoid replacing letters with common symbols, it can weaken your password. For example, if you want to use the word \u2018lucky\u2019 but instead write it as \u20181ucky.\u2019 It\u2019s too obvious because the 1 and the letter L look too similar.<\/p>\r\n

Choose a passkey over a password
<\/span><\/h5>\r\n

Whenever possible, opt for passkeys<\/a> instead of passwords. Passkeys, which are unique codes tied to your device, offer more security and are less prone to breaches. Companies such as Amazon<\/a>, Apple<\/a>, Google<\/a>, and Microsoft<\/a> are increasingly supporting passkeys as a safer alternative.<\/p>\r\n

rb-<\/em><\/h3>\r\n

We should approach NordPass\u2019 findings with caution due to their unclear methodology. They are not very transparent about their methodology. The presser said the passwords were “compiled in partnership with independent researchers specializing in researching cybersecurity incidents. They evaluated a 4.3TB database extracted from various publicly available sources…”<\/em><\/p>\r\n

There are some suspicious trends in the Nordpass’s data. English words make up all of the top 25 recognizable passwords. Quite a feat for over 24 billion<\/a> credentials breached since 2016. Many other are numerical strings or the result of typing nearby keys on a QWERTY keyboard. Despite these issues, the report makes for interesting geek reading.<\/em><\/p>\r\n

Related article<\/strong><\/p>\r\n