Bruce Schneier on Real-World Passwords

[pne]

Bruce Schneier has an article on real-world passwords—specifically, he analysed username/password combinations (allegedly) phished off MySpace.

One quote I like:

We used to quip that "password" is the most common password. Now it's "password1." Who said users haven't learned anything about security?

Besides that, he has statistics on password length, top 20 most common passwords, and character mix (letters only vs alphanumeric vs digits only vs non-alphanumeric).

And the top-20 list includes a password I use! \o/ (in a couple of places that I don't consider particularly high-security).

As an aside, I wonder how many of those top 20 passwords are in common use on LiveJournal (and how many more were in common use before LiveJournal changed its password policies).

Comments

[leighbug]

That was interesting! My password isn't on there, but...I use the same password for everything. At one point, I did try to use different ones, but I couldn't remember what password I used for what account, so I ended up locking myself out of my MSN Messenger for awhile, because I also couldn't remember what I used for my secret question.

However, my work does use password as it's password! On top of that, the passwords are taped on the computer monitor.