{"id":80328,"date":"2016-05-26T23:15:17","date_gmt":"2016-05-27T03:15:17","guid":{"rendered":"http:\/\/rbach.net\/blog\/index.php\/"},"modified":"2022-08-10T12:37:49","modified_gmt":"2022-08-10T16:37:49","slug":"lessons-from-the-linkedin-data-breach","status":"publish","type":"post","link":"https:\/\/rbach.net\/index.php\/lessons-from-the-linkedin-data-breach\/","title":{"rendered":"Lessons From the LinkedIn Data Breach"},"content":{"rendered":"

\"LessonsReaders of the Bach Seat<\/a> know that passwords<\/a> suck<\/a><\/strong> and that people are awful at picking passwords. The Business Insider<\/em><\/a> offers more proof<\/strong>. According to a recent article<\/a>, the 2012 LinkedIn data breach<\/a><\/strong> exposed a whopping 167 million accounts<\/strong> that were compromised, including 117 million passwords.<\/p>\n

\"\"<\/a>The article says the passwords were hashed or encrypted so they can’t be read, but researchers at LeakedSource<\/em><\/a> have been able to decrypt them. Their findings should be no surprise to Bach Seat followers. The results show just how much the same passwords get used over and over (and over and over and over and over) again<\/strong>.<\/p>\n

Most often used passwords<\/h3>\n

92% of the top leaked LinkedIn passwords<\/strong> were identified as the top 25 most often used passwords<\/strong> in 2011 or 2012. Nearly half of the passwords listed were the most commonly used password in 2011, 2012, or 2013. The top 5 bad passwords were used to \u201csecure\u201d over 1.2 million accounts.<\/p>\n

\"Passwords\"<\/a>The LeakedSource<\/em> data says the most<\/strong> popular password<\/strong> for LinkedIn in 2012 was 123456<\/strong>. That password was used by more than 750,000 accounts. Data<\/a> the Bach Seat<\/em> has collected says that 123456 has been the top 1 or 2 passwords every year used since 2011.<\/p>\n

The remarkably unstealthy password \u2019linkedin\u2019<\/strong> is the second most used password on these breached LinkedIn accounts with 172,523 users. That is just so wrong on so many levels.<\/p>\n

The password \u2018password\u2019<\/strong> is number three with 144,458 hacked LinkedIn users relying on it to secure their professional profile. Our historical data says that \u2018password\u2019 has swapped the top ranking with \u2018123456\u2019 since 2011.<\/p>\n

\u2018\"password<\/a>12345678\u2019<\/strong> is the fourth most popular bad LinkedIn password with 94,214 users according to LeakedSource<\/em>. This password has been a consistent #3 in my data.<\/p>\n

The data for the top 49 passwords is below. You can search for your user name<\/strong> here<\/a>\u00a0 Fix your passwords.<\/p>\n\n\n\n\n\t\n\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t
Rank<\/th>Password<\/th>Frequency<\/th>Notes<\/th>\n<\/tr>\n<\/thead>\n
1<\/td>123456<\/td>753,305<\/td>#2 in 2012<\/td>\n<\/tr>\n
2<\/td>linkedin<\/td>172,523<\/td><\/td>\n<\/tr>\n
3<\/td>password<\/td>144,458<\/td>#1 In 2012<\/td>\n<\/tr>\n
4<\/td>123456789<\/td>94,314<\/td>#6 in 2012<\/td>\n<\/tr>\n
5<\/td>12345678<\/td>63,769<\/td>#3 in 2012<\/td>\n<\/tr>\n
6<\/td>111111<\/td>57,210<\/td>#12 in 2011<\/td>\n<\/tr>\n
7<\/td>1234567<\/td>49,652<\/td>#7 in 2011<\/td>\n<\/tr>\n
8<\/td>sunshine<\/td>39,118<\/td>#15 in 2011<\/td>\n<\/tr>\n
9<\/td>qwerty<\/td>37,538<\/td>#4 in 2011<\/td>\n<\/tr>\n
10<\/td>654321<\/td>33,854<\/td>#21 in 2011<\/td>\n<\/tr>\n
11<\/td>000000<\/td>32,490<\/td>#25 in 2013<\/td>\n<\/tr>\n
12<\/td>password1<\/td>30,981<\/td>#21 in 2013<\/td>\n<\/tr>\n
13<\/td>abc123<\/td>30,398<\/td>#5 in 2011<\/td>\n<\/tr>\n
14<\/td>charlie<\/td>28,049<\/td><\/td>\n<\/tr>\n
15<\/td>linked<\/td>25,334<\/td><\/td>\n<\/tr>\n
16<\/td>maggie<\/td>23,892<\/td><\/td>\n<\/tr>\n
17<\/td>michael<\/td>23,075<\/td>#16 in 2012<\/td>\n<\/tr>\n
18<\/td>666666<\/td>22,888<\/td><\/td>\n<\/tr>\n
19<\/td>princess<\/td>22,122<\/td>#22 in 2013<\/td>\n<\/tr>\n
20<\/td>123123<\/td>21,826<\/td>#11 in 2013<\/td>\n<\/tr>\n
21<\/td>iloveyou<\/td>20,251<\/td>#9 in 2013<\/td>\n<\/tr>\n
22<\/td>1234567890<\/td>19,575<\/td>#13 in 2013<\/td>\n<\/tr>\n
23<\/td>Linkedin1<\/td>19,441<\/td><\/td>\n<\/tr>\n
24<\/td>daniel<\/td>19,184<\/td><\/td>\n<\/tr>\n
25<\/td>bailey<\/td>18,805<\/td>#17 in 2011<\/td>\n<\/tr>\n
26<\/td>welcome<\/td>18,504<\/td><\/td>\n<\/tr>\n
27<\/td>buster<\/td>18,395<\/td><\/td>\n<\/tr>\n
28<\/td>Passw0rd<\/td>18,208<\/td>#18 in 2011<\/td>\n<\/tr>\n
29<\/td>baseball<\/td>17,858<\/td>#9 in 2012<\/td>\n<\/tr>\n
30<\/td>shadow<\/td>17,781<\/td>#17 in 2011<\/td>\n<\/tr>\n
31<\/td>121212<\/td>17,134<\/td><\/td>\n<\/tr>\n
32<\/td>hannah<\/td>17,040<\/td><\/td>\n<\/tr>\n
33<\/td>monkey<\/td>16,958<\/td>#6 in 2011<\/td>\n<\/tr>\n
34<\/td>thomas<\/td>16,789<\/td><\/td>\n<\/tr>\n
35<\/td>summer<\/td>16,652<\/td><\/td>\n<\/tr>\n
36<\/td>george<\/td>16,620<\/td><\/td>\n<\/tr>\n
37<\/td>harley<\/td>16,275<\/td><\/td>\n<\/tr>\n
38<\/td>222222<\/td>16,165<\/td><\/td>\n<\/tr>\n
39<\/td>jessica<\/td>16,088<\/td><\/td>\n<\/tr>\n
40<\/td>GINGER<\/td>16,040<\/td><\/td>\n<\/tr>\n
41<\/td>michelle<\/td>16,024<\/td><\/td>\n<\/tr>\n
42<\/td>abcdef<\/td>15,938<\/td><\/td>\n<\/tr>\n
43<\/td>sophie<\/td>15,884<\/td><\/td>\n<\/tr>\n
44<\/td>jordan<\/td>15,839<\/td>#22 in 2012<\/td>\n<\/tr>\n
45<\/td>freedom<\/td>15,793<\/td><\/td>\n<\/tr>\n
46<\/td>555555<\/td>15,664<\/td><\/td>\n<\/tr>\n
47<\/td>tigger<\/td>15,658<\/td><\/td>\n<\/tr>\n
48<\/td>joshua<\/td>15,628<\/td><\/td>\n<\/tr>\n
49<\/td>pepper<\/td>15,610<\/td><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\n

rb-<\/strong><\/em><\/p>\n

The advice remains the same as I wrote about in 2010<\/a>. <\/em><\/p>\n

Strong passwords characteristics:<\/strong><\/em>
\n \u2022 At least eight (8) alpha-numeric characters<\/em>
\n \u2022 At least one numeric character (0-9)<\/em>
\n \u2022 At least one lower case character (a-z)<\/em>
\n \u2022 At least one upper case character (A-Z)<\/em>
\n \u2022 At least one non-alphanumeric character* (~, !, @, #, $, %, ^, &, *, (, ), -, =, +, ?, [, ], {, })<\/em>
\n \u2022 Are not a word in any language, slang, dialect, jargon, etc.<\/em>
\n \u2022 Are not based on personal information, names of family, etc.<\/em>
\n \u2022 Are never written down or stored online.<\/em><\/p>\n

Related articles<\/em><\/h6>\n