# Are you using one of the most common passwords? **URL:** \ **Category:** In My Humble Opinion\ **Created:** [January 20, 2015, 4:55pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393 "2015-01-20T16:55:18Z")\ **Posts on this page:** 17\ **Page:** 3
**Author:** ![astorian](https://avatars.discourse-cdn.com/v4/letter/a/ad7895/32.png) [@astorian](https://boards.straightdope.com/u/astorian)\ **Post date:** [January 21, 2015, 9:06pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/41 "2015-01-21T21:06:17Z")
> [@JerrySTL](#): > > No. I’m in charge of changing about 60 passwords every 90 days on some database servers. Here’s the requirements for the passwords: > a) Must be at least 16 characters long > b) Must _not_ contain the username > c) Must contain at least two lowercase characters: abcdefghij etc. > d) Must contain at least two uppercase characters: ABCDEFG etc. > e) Must contain at least two digits: 0123456789 > f) Must contain at least three special characters: ~!$^()`\*,-/:;\<=\>?\_ > g) Must _not_ contain a “bad” special character: Space.|@{][}+&%# > h) Must start with an alphabetical character. > i) Max of 2 repeating characters: i.e. not “111”. > j) The first 8 characters must contain at least one digit. > k) The first 8 characters must contain at least one special character. > l) The first 8 characters must contain at least one upper case letter. > m) The first 8 characters must contain at least one lower case letter. > n) Must not have been used before in the last 5 years. The GOOD news is, this makes life much harder for hackers. The bad news is, I’m betting you get a LOT of calls from people who either can’t remember their passwords or kept trying to enter their passwords and got characters wrong and then got locked out. Either that or they write down their passwords and keep them on top of their desks… which kinda defeats the purpose. ---
**Author:** ![GoodOmens](https://avatars.discourse-cdn.com/v4/letter/g/d26b3c/32.png) [@GoodOmens](https://boards.straightdope.com/u/GoodOmens)\ **Post date:** [January 21, 2015, 10:12pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/42 "2015-01-21T22:12:10Z")
I’ve been sitting here for 5 minutes trying to figure out what “let mein” means. Figured it was something in German. I think I need to go eat dinner. ---
**Author:** ![Typo\_Negative](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/typo_negative/32/484_2.png) [@Typo\_Negative](https://boards.straightdope.com/u/Typo_Negative)\ **Post date:** [January 21, 2015, 10:25pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/43 "2015-01-21T22:25:08Z")
Couldn’t we just execute hackers? That would be a lot simpler. ---
**Author:** ![foolsguinea](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/foolsguinea/32/14751_2.png) [@foolsguinea](https://boards.straightdope.com/u/foolsguinea)\ **Post date:** [January 22, 2015, 12:20am UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/44 "2015-01-22T00:20:48Z")
What’s hilarious is that | passwordpassword oink | is far more secure than | %5yZ~dew |, and probably [del]not appreciably slower[/del] much faster to type, but we keep getting pointed toward passwords that look like the latter. ---
**Author:** ![Ranger\_Jeff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ranger_jeff/32/2065_2.png) [@Ranger\_Jeff](https://boards.straightdope.com/u/Ranger_Jeff)\ **Post date:** [January 22, 2015, 12:30am UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/45 "2015-01-22T00:30:47Z")
I’m surprised “swordfish” isn’t on the list. I guess now people don’t appreciate the classics. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [January 22, 2015, 12:58am UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/46 "2015-01-22T00:58:53Z")
Even my low-security password (the one I use for accounts that shouldn’t need a password at all) isn’t on that list. No, I’m still not going to tell you what it is, but someone who knows me well enough would probably have a decent chance of (eventually) guessing it, and any of the standard cracking tools would get it fairly quickly. For my bank password, I didn’t actually set any rules for what it “needed”, but I rolled dice for every character, choosing uniformly from the set of lower-case, upper-case, digits, and shifted digits ( !@#$ etc). Naturally, this gave me a password that would satisfy most such requirements anyway. The worst was for one I had to make recently-- I kept on trying different passwords, and kept on getting the error message “Your password does not comply with length and/or complexity requirements”, without ever saying what those length and/or complexity requirements were. I got up to 20 characters, including multiples of all four categories of characters, and it still gave me the same error message. It turns out, though, that a password consisting of exactly eight lower-case letters and one digit worked. My passwords were apparently being rejected for being _too_ secure. ---
**Author:** ![eulalia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/eulalia/32/457_2.png) [@eulalia](https://boards.straightdope.com/u/eulalia)\ **Post date:** [January 22, 2015, 10:21am UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/47 "2015-01-22T10:21:49Z")
One of my coworkers made barcodes of his network and business database passwords and taped them below the keyboard on his laptop. He doesn’t seem worried that any of the rest of us can get into it; he just requested that we not send anything too outrageous from his email account. ---
**Author:** ![eulalia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/eulalia/32/457_2.png) [@eulalia](https://boards.straightdope.com/u/eulalia)\ **Post date:** [January 22, 2015, 10:29am UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/48 "2015-01-22T10:29:44Z")
I use things like lines from a poem or novel or speech, taking the first or last letters of the words and capitalizing or throwing in numbers or special characters at random. This gives me fairly hard-to-crack passwords that I can remember. This is for at work; at home I use an encrypted password vault. ---
**Author:** ![Acsenray](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/acsenray/32/4519_2.png) [@Acsenray](https://boards.straightdope.com/u/Acsenray)\ **Post date:** [January 22, 2015, 1:01pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/49 "2015-01-22T13:01:53Z")
> [@JerrySTL](#): > > No. I’m in charge of changing about 60 passwords every 90 days on some database servers. Here’s the requirements for the passwords: > a)Must be at least 16 characters long > b)Must _not_ contain the username > c)Must contain at least two lowercase characters: abcdefghij etc. > d)Must contain at least two uppercase characters: ABCDEFG etc. > e)Must contain at least two digits: 0123456789 > f)Must contain at least three special characters: ~!$^()`\*,-/:;\<=\>?\_ > g)Must _not_ contain a “bad” special character: Space.|@{][}+&%# > h)Must start with an alphabetical character. > i)Max of 2 repeating characters: i.e. not “111”. > j)The first 8 characters must contain at least one digit. > k)The first 8 characters must contain at least one special character. > l)The first 8 characters must contain at least one upper case letter. > m)The first 8 characters must contain at least one lower case letter. > n)Must not have been used before in the last 5 years. This is a recipe for passwords on sticky notes. ---
**Author:** ![campp](https://avatars.discourse-cdn.com/v4/letter/c/c5a1d2/32.png) [@campp](https://boards.straightdope.com/u/campp)\ **Post date:** [January 22, 2015, 1:12pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/50 "2015-01-22T13:12:47Z")
> [@Ranger\_Jeff](#): > > I’m surprised “swordfish” isn’t on the list. I guess now people don’t appreciate the classics. Yessirree. One private joke at our house is that “Swordfish” is the password to get in the front door. Many of our friends know it and use it. My Dad’s accounts were recently hacked, and the first thing he said to me was, “Well, they all have the same password I’ve been using for years”. :smack: ---
**Author:** ![Huvudtvatt](https://avatars.discourse-cdn.com/v4/letter/h/d6d6ee/32.png) [@Huvudtvatt](https://boards.straightdope.com/u/Huvudtvatt)\ **Post date:** [January 22, 2015, 2:09pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/51 "2015-01-22T14:09:40Z")
> [@Fear\_Itself](#): > > 1. 12345 (Up 17) That’s amazing! I have the same combination on my luggage! ---
**Author:** ![bump](https://avatars.discourse-cdn.com/v4/letter/b/7c8e57/32.png) [@bump](https://boards.straightdope.com/u/bump)\ **Post date:** [January 22, 2015, 3:16pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/52 "2015-01-22T15:16:25Z")
> [@astorian](#): > > Either that or they write down their passwords and keep them on top of their desks… which kinda defeats the purpose. That was my first thought: “I bet his users write those down on post-its and stick them to their monitors.” ---
**Author:** ![koeeoaddi](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/koeeoaddi/32/408_2.png) [@koeeoaddi](https://boards.straightdope.com/u/koeeoaddi)\ **Post date:** [January 22, 2015, 4:09pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/53 "2015-01-22T16:09:40Z")
> [@JerrySTL](#): > > No. I’m in charge of changing about 60 passwords every 90 days on some database servers. Here’s the requirements for the passwords: > a) Must be at least 16 characters long > b) Must _not_ contain the username > c) Must contain at least two lowercase characters: abcdefghij etc. > d) Must contain at least two uppercase characters: ABCDEFG etc. > e) Must contain at least two digits: 0123456789 > f) Must contain at least three special characters: ~!$^()`\*,-/:;\<=\>?\_ > g) Must _not_ contain a “bad” special character: Space.|@{][}+&%# > h) Must start with an alphabetical character. > i) Max of 2 repeating characters: i.e. not “111”. > j) The first 8 characters must contain at least one digit. > k) The first 8 characters must contain at least one special character. > l) The first 8 characters must contain at least one upper case letter. > m) The first 8 characters must contain at least one lower case letter. > n) Must not have been used before in the last 5 years. From Hell’s heart (and my elderly loved one’s various devices) I stab at thee! ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [January 22, 2015, 7:33pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/54 "2015-01-22T19:33:48Z")
I use KeePass and generate semi-random passwords. Typically they’re variations on the consonant-vowel-consonant-vowel-consonant system from old commercial telegraph codes (which generates non-words that have enough structure to be memorizable for a few seconds and accurately transcribed) with one or two random digits (2-9) and a special symbol. The only password I actually have to remember is the one for the master database, and that consists of a fairly long acronym for a phrase I know that almost certainly (Google searches on fragments thereof came up empty) doesn’t appear verbatim in any book, movie, etc. > [@GoodOmens](#): > > I’ve been sitting here for 5 minutes trying to figure out what “let mein” means. Figured it was something in German. I think I need to go eat dinner. Now you’ve got me hungry too – how does let mein compare to General Tso’s chicken or stir-fry beef? ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [January 22, 2015, 7:38pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/55 "2015-01-22T19:38:18Z")
> [@JerrySTL](#): > > No. I’m in charge of changing about 60 passwords every 90 days on some database servers. Here’s the requirements for the passwords: > a) Must be at least 16 characters long > b) Must _not_ contain the username > c) Must contain at least two lowercase characters: abcdefghij etc. > d) Must contain at least two uppercase characters: ABCDEFG etc. > e) Must contain at least two digits: 0123456789 > f) Must contain at least three special characters: ~!$^()`\*,-/:;\<=\>?\_ > g) Must _not_ contain a “bad” special character: Space.|@{][}+&%# > h) Must start with an alphabetical character. > i) Max of 2 repeating characters: i.e. not “111”. > j) The first 8 characters must contain at least one digit. > k) The first 8 characters must contain at least one special character. > l) The first 8 characters must contain at least one upper case letter. > m) The first 8 characters must contain at least one lower case letter. > n) Must not have been used before in the last 5 years. Were there any rules defining which color of sticky note to write it on? EDIT: Ninja sticky note found on my monitor… ---
**Author:** ![usedtobe](https://avatars.discourse-cdn.com/v4/letter/u/ec9cab/32.png) [@usedtobe](https://boards.straightdope.com/u/usedtobe)\ **Post date:** [January 23, 2015, 4:50am UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/56 "2015-01-23T04:50:53Z")
For 30+ years, I have used a vowel substitution of a nonsense word from a comic strip. It is neither a word in any known (to me) language nor a proper noun. Another password series is based on that street address drilled into my 8 yr old brain by a Mother certain I would get lost - wandering as I did as far a six blocks from home. (yes, I know - a modern mother allowing an 8 yr old to wander the neighborhood with his friends would be arrested for neglect/endangerment. Poor kids.) ---
**Author:** ![StusBlues](https://avatars.discourse-cdn.com/v4/letter/s/dc4da7/32.png) [@StusBlues](https://boards.straightdope.com/u/StusBlues)\ **Post date:** [January 27, 2015, 1:05pm UTC](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393/58 "2015-01-27T13:05:52Z")
> [@chiroptera](#): > > Nope. > > But most are some form of the “primary” password I’ve used for 20 years (with random numbers, punctuation and a mix of upper and lower case added) and, yes, I have a list of them written down dinosaur-style on paper\* and updated as needed. > > \*Well I figure that when I die, anyone going through my personal effects will find that list and be able to use up my PayPal account, Chase Bank accounts and what-not. Since if I am dead, I won’t care. This. My password is pretty obscure (dead language - not Latin or Slavonic - with numbers and capitals mixed in), but I’ve used some variant of it for the better part of a decade. I do switch it up for my bank account, though. [Previous page](https://boards.straightdope.com/t/are-you-using-one-of-the-most-common-passwords/710393.md?page=2)