# Are you using one of the most common passwords? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [January 20, 2015, 4:55pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393 "2015-01-20T16:55:18Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Fear\_Itself](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fear_itself/32/19637_2.png) [@Fear\_Itself](https://boards.straightdope.com/u/Fear_Itself)\ **Post date:** [January 20, 2015, 4:55pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/1 "2015-01-20T16:55:18Z")
Gizmodo just published this year’s list of the [25 most common passwords](http://gizmodo.com/the-25-most-popular-passwords-of-2014-were-all-doomed-1680596951?utm_source=recirculation&utm_medium=recirculation&utm_campaign=tuesdayAM) (followed by the change in rank from last year’s list0: 1. 123456 (Unchanged) 2. password (Unchanged) 3. 12345 (Up 17) 4. 12345678 (Down 1) 5. qwerty (Down 1) 6. 123456789 (Unchanged) 7. 1234 (Up 9) 8. baseball (New) 9. dragon (New) 10. football (New) 11. 1234567 (Down 4) 12. monkey (Up 5) 13. letmein (Up 1) 14. abc123 (Down 9) 15. 111111 (Down 8) 16.mustang (New) 1. access (New) 2. shadow (Unchanged) 3. master (New) 4. michael (New) 5. superman (New) 6. 696969 (New) 7. 123123 (Down 12) 8. batman (New) 9. trustno1 (Down 1) Are you currently using any of these passwords, anywhere, for any account? ---
**Author:** ![QuickSilver](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/quicksilver/32/7832_2.png) [@QuickSilver](https://boards.straightdope.com/u/QuickSilver)\ **Post date:** [January 20, 2015, 5:23pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/2 "2015-01-20T17:23:15Z")
Yes. My personal checking and saving bank accounts at Citi Bank. User id: QuickSilver. Why? ---
**Author:** ![Left\_Hand\_of\_Dorkness](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/left_hand_of_dorkness/32/7156_2.png) [@Left\_Hand\_of\_Dorkness](https://boards.straightdope.com/u/Left_Hand_of_Dorkness)\ **Post date:** [January 20, 2015, 5:23pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/3 "2015-01-20T17:23:41Z")
I love “shadow,” “batman,” “master,” and “trustno1,” clearly passwords chosen by leet hacker types very proud of their cleverness. The answer of course is “no.” I have phrases that only I know (here’s a major security leak: if you’re familiar with the angsty poetry I wrote as an adolescent, you might know them, too!), and I convert them into alphanumeric passwords. I think they’d be tricky to guess. ---
**Author:** ![Si\_Amigo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/si_amigo/32/2877_2.png) [@Si\_Amigo](https://boards.straightdope.com/u/Si_Amigo)\ **Post date:** [January 20, 2015, 5:42pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/4 "2015-01-20T17:42:08Z")
Does P@55w0rD count? Or how about 87654321. ? The period is the security feature that always throws them off! ---
**Author:** ![Machine\_Elf](https://avatars.discourse-cdn.com/v4/letter/m/82dd89/32.png) [@Machine\_Elf](https://boards.straightdope.com/u/Machine_Elf)\ **Post date:** [January 20, 2015, 6:13pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/5 "2015-01-20T18:13:26Z")
My passwords are all obscure. Since we are regularly warned not to use the same password for multiple accounts, my password for each of my accounts is also unique. In the news the other day they mentioned [people getting their frequent flyer mileage accounts “hacked.”](http://www.consumeraffairs.com/news/frequent-flyer-miles-stolen-from-american-and-united-airlines-passengers-011315.html) This is a problem because the miles can be used like cash to buy goods. Apparently these people had used the same password for the FF account as they had on some other account; the other account is what actually got hacked, and then the thieves just used that password to get at their FF miles. ---
**Author:** ![aruvqan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aruvqan/32/2891_2.png) [@aruvqan](https://boards.straightdope.com/u/aruvqan)\ **Post date:** [January 20, 2015, 7:06pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/6 "2015-01-20T19:06:14Z")
Nope. Though I can generally figure out one of my friends, he cycles through WW2 Japanese Capital ship names. My favorite passwords actually come off a list generated for me by a friend, they have absolutely nothing to do with any facet of my real life, he even generated fake family names and history to cover the security questions. You can social engineer my senile mom as much as you like, none of the information you get from her will match my fake info =) ---
**Author:** ![dangermom](https://avatars.discourse-cdn.com/v4/letter/d/e274bd/32.png) [@dangermom](https://boards.straightdope.com/u/dangermom)\ **Post date:** [January 20, 2015, 7:08pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/7 "2015-01-20T19:08:50Z")
No. Mine are all weird. ---
**Author:** ![JerrySTL](https://avatars.discourse-cdn.com/v4/letter/j/e274bd/32.png) [@JerrySTL](https://boards.straightdope.com/u/JerrySTL)\ **Post date:** [January 20, 2015, 7:15pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/8 "2015-01-20T19:15:27Z")
No. I’m in charge of changing about 60 passwords every 90 days on some database servers. Here’s the requirements for the passwords: a) Must be at least 16 characters long b) Must _not_ contain the username c) Must contain at least two lowercase characters: abcdefghij etc. d) Must contain at least two uppercase characters: ABCDEFG etc. e) Must contain at least two digits: 0123456789 f) Must contain at least three special characters: ~!$^()`\*,-/:;\<=\>?\_ g) Must _not_ contain a “bad” special character: Space.|@{][}+&%# h) Must start with an alphabetical character. i) Max of 2 repeating characters: i.e. not “111”. j) The first 8 characters must contain at least one digit. k) The first 8 characters must contain at least one special character. l) The first 8 characters must contain at least one upper case letter. m) The first 8 characters must contain at least one lower case letter. n) Must not have been used before in the last 5 years. ---
**Author:** ![Projammer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/projammer/32/559_2.png) [@Projammer](https://boards.straightdope.com/u/Projammer)\ **Post date:** [January 20, 2015, 7:21pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/9 "2015-01-20T19:21:24Z")
Yes. I have read access to several completely trivial systems. Roughly the equivalent of pulling up an hourly weather report. ETA: You forgot one **JerrySTL** o) Password must not be written down or stored in a file. ---
**Author:** ![Gus\_Gusterson](https://avatars.discourse-cdn.com/v4/letter/g/85f322/32.png) [@Gus\_Gusterson](https://boards.straightdope.com/u/Gus_Gusterson)\ **Post date:** [January 20, 2015, 7:23pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/10 "2015-01-20T19:23:17Z")
> [@Fear\_Itself](#): > > Are you currently using any of these passwords, anywhere, for any account? Yes. I run some virtual machines on my computer. All of these virtual machines have the password “password”. I’ve been doing this for years and haven’t had any problems. If one of the VMs did get compromised I would just destroy and recreate it. An attacker wouldn’t be able to get from the VM to the host machine and someone who had control of the host machine wouldn’t bother with the VMs so I don’t bother worrying about them. ---
**Author:** ![JerrySTL](https://avatars.discourse-cdn.com/v4/letter/j/e274bd/32.png) [@JerrySTL](https://boards.straightdope.com/u/JerrySTL)\ **Post date:** [January 20, 2015, 7:26pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/11 "2015-01-20T19:26:56Z")
> [@Projammer](#): > > ETA: You forgot one **JerrySTL** o) Password must not be written down or stored in a file. What? 😃 I did forget that all 60 passwords are suppose to be different. :eek: Try to remember all of them! Usually it’s just one or two numbers different. ---
**Author:** ![Stuffy](https://avatars.discourse-cdn.com/v4/letter/s/f17d59/32.png) [@Stuffy](https://boards.straightdope.com/u/Stuffy)\ **Post date:** [January 20, 2015, 7:45pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/12 "2015-01-20T19:45:52Z")
> [@JerrySTL](#): > > No. I’m in charge of changing about 60 passwords every 90 days on some database servers. Here’s the requirements for the passwords: > a) Must be at least 16 characters long > b) Must _not_ contain the username > c) Must contain at least two lowercase characters: abcdefghij etc. > d) Must contain at least two uppercase characters: ABCDEFG etc. > e) Must contain at least two digits: 0123456789 > f) Must contain at least three special characters: ~!$^()`\*,-/:;\<=\>?\_ > g) Must _not_ contain a “bad” special character: Space.|@{][}+&%# > h) Must start with an alphabetical character. > i) Max of 2 repeating characters: i.e. not “111”. > j) The first 8 characters must contain at least one digit. > k) The first 8 characters must contain at least one special character. > l) The first 8 characters must contain at least one upper case letter. > m) The first 8 characters must contain at least one lower case letter. > n) Must not have been used before in the last 5 years. I have similar requirements. I can routinely guess my friends and families passwords. Good thing I’m nor evil or anything. ---
**Author:** ![Gatopescado](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gatopescado/32/5711_2.png) [@Gatopescado](https://boards.straightdope.com/u/Gatopescado)\ **Post date:** [January 20, 2015, 7:51pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/13 "2015-01-20T19:51:12Z")
My state has a website to apply for state jobs and it also is used by current employees for time keeping. They have rules like **Jerry** posted above and make everybody change the account password frequently. A friend with a state job tells me that on nearly everybody’s screen is a post-it note with the current password written down on it! 😃 ---
**Author:** ![UncleRojelio](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/unclerojelio/32/3160_2.png) [@UncleRojelio](https://boards.straightdope.com/u/UncleRojelio)\ **Post date:** [January 20, 2015, 8:00pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/14 "2015-01-20T20:00:42Z")
No, not since i started using a password manager anyway. ---
**Author:** ![That\_Don\_Guy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/that_don_guy/32/538_2.png) [@That\_Don\_Guy](https://boards.straightdope.com/u/That_Don_Guy)\ **Post date:** [January 20, 2015, 8:03pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/15 "2015-01-20T20:03:08Z")
> [@JerrySTL](#): > > No. I’m in charge of changing about 60 passwords every 90 days on some database servers. Here’s the requirements for the passwords: > a) Must be at least 16 characters long > b) Must _not_ contain the username > c) Must contain at least two lowercase characters: abcdefghij etc. > d) Must contain at least two uppercase characters: ABCDEFG etc. > e) Must contain at least two digits: 0123456789 > f) Must contain at least three special characters: ~!$^()`\*,-/:;\<=\>?\_ > g) Must _not_ contain a “bad” special character: Space.|@{][}+&%# > h) Must start with an alphabetical character. > i) Max of 2 repeating characters: i.e. not “111”. > j) The first 8 characters must contain at least one digit. > k) The first 8 characters must contain at least one special character. > l) The first 8 characters must contain at least one upper case letter. > m) The first 8 characters must contain at least one lower case letter. > n) Must not have been used before in the last 5 years. What, no “must have at least 4 characters different from the previous password” rule? Without it, just find two consecutive digits and increment the value by 1 for each change; that’s 100 different passwords. Back when I was in college in the 1980s, the most popular password apparently was “spaceman”. ---
**Author:** ![BobLibDem](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/boblibdem/32/3149_2.png) [@BobLibDem](https://boards.straightdope.com/u/BobLibDem)\ **Post date:** [January 20, 2015, 8:13pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/16 "2015-01-20T20:13:26Z")
> [@JerrySTL](#): > > No. I’m in charge of changing about 60 passwords every 90 days on some database servers. Here’s the requirements for the passwords: > a) Must be at least 16 characters long > b) Must _not_ contain the username > c) Must contain at least two lowercase characters: abcdefghij etc. > d) Must contain at least two uppercase characters: ABCDEFG etc. > e) Must contain at least two digits: 0123456789 > f) Must contain at least three special characters: ~!$^()`\*,-/:;\<=\>?\_ > g) Must _not_ contain a “bad” special character: Space.|@{][}+&%# > h) Must start with an alphabetical character. > i) Max of 2 repeating characters: i.e. not “111”. > j) The first 8 characters must contain at least one digit. > k) The first 8 characters must contain at least one special character. > l) The first 8 characters must contain at least one upper case letter. > m) The first 8 characters must contain at least one lower case letter. > n) Must not have been used before in the last 5 years. [What, no doodles, sign language, or squirrel noises?](http://dilbert.com/strip/2005-09-10) ---
**Author:** ![dracoi](https://avatars.discourse-cdn.com/v4/letter/d/90db22/32.png) [@dracoi](https://boards.straightdope.com/u/dracoi)\ **Post date:** [January 20, 2015, 9:09pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/17 "2015-01-20T21:09:54Z")
Nope. All of my passwords contain at least one capital letter, one letter, one number and one item of punctuation. The rest of the password is a combination of two pieces of information that are easy to remember separately, but not so easy to guess. So one entirely hypothetical example, if my dog’s is name Spot, I might create a password that is Dog1=Spot! That relationship is very easy for me to remember because it’s useful and relatable information… but even if you knew I had a password based on my dog’s name, are you going to be able to guess that exact password? Not likely; the punctuation alone creates millions of possible options. Also… my security questions are never real answers. They’re passwords of their own. So if the security question is “Where did you meet your wife?” I might just put “Dog1=Spot!” there as well. Otherwise, you can break most people’s security questions just by looking at their FaceBook page. ---
**Author:** ![Jackmannii](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jackmannii/32/311_2.png) [@Jackmannii](https://boards.straightdope.com/u/Jackmannii)\ **Post date:** [January 20, 2015, 9:33pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/18 "2015-01-20T21:33:34Z")
My passwords are so incredibly obscure that I cannot remember them, and so neither I nor anyone can access sensitive information. Which I gather is the point of password security. ---
**Author:** ![OffByOne](https://avatars.discourse-cdn.com/v4/letter/o/45deac/32.png) [@OffByOne](https://boards.straightdope.com/u/OffByOne)\ **Post date:** [January 20, 2015, 9:59pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/19 "2015-01-20T21:59:45Z")
> [@JerrySTL](#): > > (Clip) > g) Must _not_ contain a “bad” special character: Space.|@{][}+&%# > (Clip) Why are those “bad” special characters? I see a few of them that I use from time to time. One place I worked would not let you use any special characters other than ‘-’ and ‘\_’. Grrr. Another place I worked said that my password had to have 3 of the 4 categories of characters: lower case alpha, upper case alpha, numerals, special character. I tried a password that had a lower case letter, and upper case letter, and a numeral. It wouldn’t let me use that password. I had to add a special character. I don’t have a problem with that, but don’t tell me I can skip one of the categories, then tell me, “No, not that one!” ---
**Author:** ![CalMeacham](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/calmeacham/32/35_2.png) [@CalMeacham](https://boards.straightdope.com/u/CalMeacham)\ **Post date:** [January 20, 2015, 10:50pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/20 "2015-01-20T22:50:29Z")
Aha! I’m onto you. You just want to eliminate those 25 possibilities when you do an exhaustive search through the possibilities of my passwords. Well, I’m not going to tell you! [Next page](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393.md?page=2)