There’s a list of “The Top 10 Most Common Online Passwords” making the rounds of the media outlets (originating with PC Magazine?)
Most of them are what one would expect (“abc123”, “password”, “letmein”) - but #9 seems right out of left field: “blink182”. OK, so Google turns up a '90’s punk rock band by that name, but what would make people use this so often that it’s in the top ten list?
And, if they could be bothered to spell the band’s name correctly, it also includes a symbol, but no upper-case letters - blink-182 - so it has three of four complexities.
I’ll throw out a WAG that with the current size and scope of botnets (including service providers such as mass email services, email relay services, one-stop-shopping for all of your abusive advertising and fraud needs), a particular individual or his/her minions working that angle could bubble up a statistically significant number of botnet-owned passwords.
I’d be curious to know the methods and time-fram of the samples taken in any research audits.
From Schneier’s page linked above, this one was a “white hat” phishing attempt that took advantages of some flaws in how MySpace operates - someone created a MySpace user account called login_home_index_html which was more than clever enough to fool 100,000 people to attempt logging in there. The time frame was basically until MySpace wised up and shut down the phishing page.