# 32 million passwords exposed. Most popular....123456 **URL:** \ **Category:** In My Humble Opinion\ **Created:** [April 13, 2010, 7:19pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977 "2010-04-13T19:19:17Z")\ **Posts on this page:** 18\ **Page:** 4
**Author:** ![statsman1982](https://avatars.discourse-cdn.com/v4/letter/s/e79b87/32.png) [@statsman1982](https://boards.straightdope.com/u/statsman1982)\ **Post date:** [April 15, 2010, 3:32am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/61 "2010-04-15T03:32:37Z")
> [@Napier](#): > > We need a name for passwords for things that shouldn’t need passwords - for example, web sites that make you register to read, say, their prices for products. > > I propose the term “asswords”. > > For a while I would have a standard assword construction that combined the name of the offending party with a hateful and derogatory curse. Then I started getting creative, and it got complicated enough I forgot how it worked, and it all fell through. > I really hate the almost 90 passwords I’m up to, which I use on about 8 different computers on different networks, so of course they’re in a list somewhere. > > I also hate all the rules. Must combine uppercase and lowercase letters, plus numbers. Or, must be five letters, case-insensitive. Automatic forced changes with fancy methods of detecting pattern usage and blocking it. > > WHY WHY WHY can’t we have thumb print readers, or webcams to look at our irises, or something trouble free like that? Have you ever seen _Demolition Man_?😛 ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [April 15, 2010, 4:33am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/62 "2010-04-15T04:33:12Z")
> [@Gustav](#): > > Meh, I gave up on secure passwords years ago. Too much work. I use the same super-simple password for everything. Go ahead, hack my forum account, read my e-mails, order stuff on my amazon account, what do I care. Joke’s on you, signups are free anyway. For less effort than hacking my account you could create your very own. Reading your emails isn’t where they’ll get ya: It’s taking over your account and sending viruses to your friends and getting you on major spam filters. Like I said, I just got hacked. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [April 15, 2010, 7:36am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/63 "2010-04-15T07:36:02Z")
> [@tr0psn4j](#): > > There was a log of an IRC conversation I read that went something like that. > > “My password is \*\*\*\*” > “Well mine is \*\*\*\*\*\*\*” > “Wow that works?” > “yes” > “Cool! my password is 420the666kid69” > > People on the internet can be stupid. 🙂 > > Also, on #apprentice, one of the @s (Brimstone was his name I think) was notorious for typos. On multiple occassions he typed “j/oin #e-judge cabbage” into #apprentice which gave away the password to over 100 people. > > Those were some good times. ☹ My workplace introduced mandatory strong passwords (\>9 characters, a mix including at least three different types out of upper, lower, numeric and symbols) last year - it caused widespread confusion, with people unable understand the requirements, or unable to consistently enter their passwords. Some of them just wrote their passwords on post-its and stuck them to the screen - others, who had trouble typing them into the masked field called colleagues over, saying “Look, watch me to make sure I’m typing this (waving a piece of paper with the password on it) correctly - watch me type it in to make sure I’m doing it right!” ---
**Author:** ![septimus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/septimus/32/410_2.png) [@septimus](https://boards.straightdope.com/u/septimus)\ **Post date:** [April 15, 2010, 9:14am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/64 "2010-04-15T09:14:30Z")
> [@fusoya](#): > > [So how strong is your doper password?.. > Seriously folks, there’s no good reason not to have a strong password… I try to use good passwords for anything connected to money, but am more worried about keyboard sniffers than password crackers. I wouldn’t want to use the same password at an “unimportant” site. Hack the unimportant site, then steal my money from another site? No thanks. My Doper password may be very easy to guess. Go ahead and guess it and forge some **septimus** posts if you want. (It will probably improve the average septimus post quality.) ---
**Author:** ![GuanoLad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guanolad/32/42_2.png) [@GuanoLad](https://boards.straightdope.com/u/GuanoLad)\ **Post date:** [April 15, 2010, 9:21am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/65 "2010-04-15T09:21:32Z")
> [@robardin](#): > > I was a sysadmin for my high school computer lab, and when decommissioning an old system did a password dump. That’s all you have to do to get everybody’s password? That doesn’t sound right. ---
**Author:** ![Markxxx](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@Markxxx](https://boards.straightdope.com/u/Markxxx)\ **Post date:** [April 15, 2010, 10:03am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/66 "2010-04-15T10:03:18Z")
As former systems admin all the changing of passwords did was force people to write them on sticky notes. Hardly any better. But that ruling of changing passwords came from corporate and I’d get slammed on my audit if I didn’t enforce it. So I did. I recall at that hotel the controller had a password of “1” 🙂 I was like, yeah here’s a lady with access to ALL the hotel financial information, not to meniton access to all the personnel files with income, insurance and reviews. Yep, that’s a good password 🙂 A lot of guys use sports teams at their passwords. I had a couple of men get into trouble when their NOW present girlfriends found out they were using their old girlfriend’s name as a password. The real problem is when you use the same password for everything. Like your password on the SD should never be the same as your banking or credit card or any such sites. And you should change passwords on banking sites at least 2 times per year. ---
**Author:** ![Markxxx](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@Markxxx](https://boards.straightdope.com/u/Markxxx)\ **Post date:** [April 15, 2010, 10:07am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/67 "2010-04-15T10:07:45Z")
> [@septimus](#): > > I try to use good passwords for anything connected to money, but am more worried about keyboard sniffers than password crackers. Though you make a good point, the fact is, it is still much easier to simpy dumpster dive than to go to all that trouble or use social networking to get the info. One thing I found in two hotels I worked at was clerks were selling information. This is a REAL problem. The H/R clerk was selling social security numbers and the accounting clerk was selling credit card numbers. These are jobs that pay $1 more than minimum wage. This is why you NEVER put your social security number on a job application. Write in, “Will provided upon request.” If a company has no intention of going beyond interview #1 they have no need for information like that. If they are serious and want to investigate your background then fine. The H/R clerk would wait six months then take all the old, stale, job applications and then sell them. Same with the accounting clerk. Which is another good reason to at least once per year, call in your credit cards as stolen/missing and get new numbers. So your old numbers aren’t sitting around for some minimum wage clerk to sell ---
**Author:** ![rhubarbarin](https://avatars.discourse-cdn.com/v4/letter/r/eb9ed0/32.png) [@rhubarbarin](https://boards.straightdope.com/u/rhubarbarin)\ **Post date:** [April 15, 2010, 11:33am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/68 "2010-04-15T11:33:29Z")
My password for almost everything is one 6-letter word (well, a name really - no not my own!), or sometimes that word doubled and combined with uppercase/lowercase and numbers. It’s been the same thing my entire online life (14 years now!) and I’ve never been hacked. I’m apathetic about hacking. My checking and savings accounts force me to change my password regularly and require uppercase, lowercase, and multiple numbers and symbols. ---
**Author:** ![dhkendall](https://avatars.discourse-cdn.com/v4/letter/d/a9adbd/32.png) [@dhkendall](https://boards.straightdope.com/u/dhkendall)\ **Post date:** [April 15, 2010, 12:55pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/69 "2010-04-15T12:55:32Z")
I have two basic passwords (one 6 characters, one 7 characters), the first was the first password assigned to me from my very first Internet account back in April 1994, the second was, you guessed it, the random password my second ISP gave me (December 1994). both are random letter-number combo that’s quite hard to guess, at least I havent’ been compromised in 16 years as a netizen yet (knock on wood). It’s when I’m required to provide something longer than 7 digits (or 8 I guess, I could through a symbol at the end of the 7) that I start to get uncreative (which worries me somewhat, as that’s where some of the more important sites are). I do find the OP and topic interesting, as when I’m out with my iPod touch and come across a locked hotspot, I’d see if I can guess the password on the first try - usually I’m unsuccessful, but then I’ve been assuming that people knew about password security, so I try more difficult passwords in my guessings. “123456” here I come! ---
**Author:** ![robardin](https://avatars.discourse-cdn.com/v4/letter/r/43a26b/32.png) [@robardin](https://boards.straightdope.com/u/robardin)\ **Post date:** [April 15, 2010, 1:28pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/70 "2010-04-15T13:28:22Z")
> [@GuanoLad](#): > > That’s all you have to do to get everybody’s password? That doesn’t sound right. I didn’t tell you how old this system was. We were decomissioning it in 1987 to replace it with a bunch of IBM ATs with the 5-1/4" floppy drives (TWO of them!). It was a “mini-computer” (i.e., mini-mainframe) setup with about 12 terminals, no connection to anything like “the Internet” except for a modem with two rubber cups to fit over a telephone receiver (one for the earpiece and one for the mouthpiece) which I only ever saw in action once, presumably to demonstrate something like UUCP. I don’t even remember what operating system it ran; based on my subsequent life experience though, I can say it wasn’t any flavor of Unix, VAX/VMS, IBM/CMS or CDC Cyber. The “password dump” I referred to was just us going in as the system user and going through all the user accounts, so we could find out the person’s name and (if still at the school) send them a message that we were decommissioning the system and to print out (no “saving”) any work they cared to retain. The screen that came up for each user showed their name, other contact info and current password (editable and viewable). So not really a dump (as in a bulk data drop), so much as a browse/walk. ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [April 15, 2010, 4:18pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/71 "2010-04-15T16:18:23Z")
I came here to dump on you guys and say that you’re potentially giving bad guys ideas on password cracking. Not that they need much help with passwords like “123456.” And you’re endangering your own accounts. I’m not telling my sooper sekrit password algorithm. No hints whatsoever. 😉 ---
**Author:** ![Mom-of-Andrew](https://avatars.discourse-cdn.com/v4/letter/m/8c91f0/32.png) [@Mom-of-Andrew](https://boards.straightdope.com/u/Mom-of-Andrew)\ **Post date:** [April 15, 2010, 5:10pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/72 "2010-04-15T17:10:14Z")
When ATM cards were still fairly new, the pin numbers were computer generated and randomly assigned. My first one? My then fiancee’s birthday. He told me it was a sign. I married him anyway. 😃 At one point I worked for a very small family firm. Each computer required a password to sign on. The owner’s daughter was a ditz, but she needed to be able to access my computer. I used her husband’s first name as my password – she could remember it, and anyone who knew how I felt about her would never think I’d use it. The office manager (owner’s wife) thought this was a _great_ idea. She made everyone in the office use her son-in-law’s name as a log-in password. Including the ditz daughter, who had his picture and name scrawled all around her work station, just like junior high. :smack: (There were many, many ways this job resembled junior high) ---
**Author:** ![Happy\_Scrappy\_Hero\_Pup](https://avatars.discourse-cdn.com/v4/letter/h/ea5d25/32.png) [@Happy\_Scrappy\_Hero\_Pup](https://boards.straightdope.com/u/Happy_Scrappy_Hero_Pup)\ **Post date:** [April 17, 2010, 4:47am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/73 "2010-04-17T04:47:23Z")
Somebody change the combination on my luggage! [sub]can’t believe we’re two pages in and i’m the first to do that…[/sub] ---
**Author:** ![kidchameleon](https://avatars.discourse-cdn.com/v4/letter/k/898d66/32.png) [@kidchameleon](https://boards.straightdope.com/u/kidchameleon)\ **Post date:** [April 17, 2010, 6:05am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/74 "2010-04-17T06:05:00Z")
> [@Happy\_Scrappy\_Hero\_Pup](#): > > [sub]can’t believe we’re two pages in and i’m the first to do that…[/sub] Don’t believe it. One of these days I’m going to register somewhere with the username password and my password username. I confuse the IT guys all the time with my laptop. “What’s your password?” “Nothing.” Presses enter. “Didn’t work.” “Did you type in Nothing?” “Ohhhh.” ---
**Author:** ![matt\_mcl](https://avatars.discourse-cdn.com/v4/letter/m/7ab992/32.png) [@matt\_mcl](https://boards.straightdope.com/u/matt_mcl)\ **Post date:** [April 17, 2010, 6:29am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/75 "2010-04-17T06:29:21Z")
I remember hearing about a security expert who’s reviewing the procedures for a building. First thing he says as he walks into the meeting: “All of your combination door locks have the code 1111, right?” Building manager looks dumbfounded. “How did you know?” :rolleyes: “Because the number 1 was worn off all the keypads.” ---
**Author:** ![EvilTOJ](https://avatars.discourse-cdn.com/v4/letter/e/ee59a6/32.png) [@EvilTOJ](https://boards.straightdope.com/u/EvilTOJ)\ **Post date:** [April 17, 2010, 7:00am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/76 "2010-04-17T07:00:39Z")
Passwords are the only legitimate use of leet speak. I use two profane words with a letter changed to a number and/or a symbol. So Sh1tf@c3 would be a possible password. I had a boss with a four letter name I would use sometimes. I hate the password restrictions at work. You have to change the password every 45 days for Novell, and it it remembers every password for the last two years. Upper/lower case, special character, and a number and exactly 8 characters. The example above would fit. They don’t realize that it’s very easy to get passwords. Hell, I work in the helpdesk and about 1 out of every 10 password calls they caller just gives me their old password, or what they want it set to! If I were to just call one of these plants and say I’m from the helpdesk and needed a password verification I could totally get it. I had a random call today from someone claiming to be from my credit union. He wanted me to verify everything like my account and SSN and address. I got warning bells and just asked what this was all about. Turns out it was for a late car payment, so he was legit. But how would I know at first? I also have a post-it note under my keyboard that says “You didn’t really think I’d keep my password here, did you?” 😃 > [@control-z](#): > > I’m not telling my sooper sekrit password algorithm. No hints whatsoever. 😉 control-v 😃 ---
**Author:** ![Mona\_Lisa\_Simpson](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Mona\_Lisa\_Simpson](https://boards.straightdope.com/u/Mona_Lisa_Simpson)\ **Post date:** [April 17, 2010, 9:34am UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/77 "2010-04-17T09:34:27Z")
My boyfriend always used 1203 for things requiring 4 digit PINs. Then his mother died on December 3rd. Creeped him right out. Then last year I got assigned a set of keys numbered 1203 at work. Creeped both of us out, but he figured his mother had now accepted me as part of the family. :rolleyes: My work passwords expire every three months, which doesn’t bother me. I have a little system that is easy for me and I don’t have to write it down. It involves foreign language words and a number string. IE pring20temps10 (only not this one incase you want to read what my patients ate for breakfast.) Because I have to change work passwords every 90 days, I change my banking etc at the same time, just a regular reminder, and have a different system of revolving combinations that only make sense to me. First syllable of an aunt on my dad’s side’s name, second syllable of an uncle on mom’s for example. (10 each side, which gives me years and years of new passwords) With numbers and symbols. mY6!wARd17? (with June 17th having its own meaning to me) Canadian postal codes also make semi secure passwords, just don’t use your own. ---
**Author:** ![Raguleader](https://avatars.discourse-cdn.com/v4/letter/r/258eb7/32.png) [@Raguleader](https://boards.straightdope.com/u/Raguleader)\ **Post date:** [April 17, 2010, 3:41pm UTC](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977/78 "2010-04-17T15:41:59Z")
I’m reminded of a scene on Babylon 5 where the Captain, the XO, and the Chief of Security all have to input their passwords into the system to reset the station’s computer and flush out any malicious code that might have been added since the station started operations a few years earlier. Anyhow, the Captain and the XO both give their passwords, and then the security chief gives his password… “Peekaboo” The XO looks at him for a moment, and asks “… Peekaboo?” “Would YOU have guessed it?” What makes it funny is that the security chief is infamously paranoid and thorough, obsessing over opsec and such. He once convinced a security official from Earth that he couldn’t share some requested information because the security chief didn’t even allow the SECURITY CHIEF to know that kind of stuff, and he’d hate to get in trouble with himself over the breach of policy… So yeah, his password into the station’s central command interface is “Peekaboo” because nobody would even think that it would be his password. [Rule of Funny](http://tvtropes.org/pmwiki/pmwiki.php/Main/RuleOfFunny) and all that. [Previous page](https://boards.straightdope.com/t/32-million-passwords-exposed-most-popular-123456/535977.md?page=3)