Passwords leaked from Yahoo: Boozy, preachy, angry -- and easy
- 13 July, 2012 01:02
For 333 people who used "ninja" as a password for Yahoo Mail or another Web service, Thursday was the day their fleet-footed, black-clad cover was blown.
A group of hackers calling itself "the D33Ds Company" published a list of 453,492 email addresses and passwords in plain text on Thursday, saying they had found them by hacking into a database associated with an unnamed Yahoo service. The passwords weren't all for Yahoo services; they also come from domain names including gmail.com, hotmail.com and aol.com.
A look through the compromised account information says a lot about Web users and security: First of all, a lot of them don't have much of it.
The most common password in the list is "123456," a simple jaunt across the keyboard that was used for 1,673 of the accounts. Another popular option was "##########," which 1,279 users chose. The fact that this password is longer and utilizes non-alphanumeric characters, both of which are common recommendations from password experts, shouldn't really make those 1,279 people rest easier.
Then again, 804 users faced with having to create a username and password for their private information promptly entered "password." More than 500 others started their passwords with "password," giving hackers a nice head start.
However, password hackers have been warned: "donthack," "donthackme," and "dontdoit" are timely reminders to anyone who wants to use a cracking mechanism that runs through the lowercase alphabet. One accountholder was more vehement: "dontdoit!" the password warned.
The antiquated username-password method of online authentication deserves some of the blame for weak protection. Users forced to come up with one more unique combination of letters, numbers and punctuation, then periodically change it, get frustrated for good reason. The passwords revealed on Thursday included "dontforget" on six accounts. One weary user created, "dontforgetdummy." Seventeen others came up with a reminder and password all rolled into one: "changeme."
Passwords are also a window into the ups and downs of Internet life. Though one account holder declared in his password, "iamhappyalways," and five chose, "iamgreat," there were five with "lifesucks," and a heartfelt, "lifesucksman." Eight chose simply, "sorrow." Seven users told the sign-up process to "gotohell," though one chose, "gotoheaven."
Looking for a way out, a few inevitably looked to the bottle. Boozy passwords included, "beerisgood," "beer4me," "beertime" and simply, "alcohol" -- chosen by four people. Religion is another major theme: "jesus" appears 40 times, while the slightly more protective "jesus1" is the password on 101 accounts.
Eventually, along with the frustrations of setting up an online account comes the other end of it. Not one but two of the accounts revealed on Thursday used the password, "accountclosedpissoff."
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
Why change management doesn’t work
Larry Page wants to see your medical records
Dual-Persona Smartphones Not a BYOD Panacea
After two-year hiatus, EFF accepts bitcoin donations again
CIOs struggle to deliver timely mobile business apps: survey
Securing the Road to Virtualization and Beyond
Traditional security controls for enterprise don’t necessarily translate into the new world of virtualisation and cloud environments. When mapping out a secure virtualisation roadmap, click to find out about pave a more secure, risk free path.
Batten Down the Hatches! A Guide to Protecting Data in Motion
The risks facing high-speed data networks and unencrypted data while in motion are very real and on the rise. As information becomes one of the most valuable ‘off balance sheet’ assets, protection of that information and the investment in it is a paramount obligation of office-holders and management. Read now for a better understanding of the risks to data in motion.
Integrated Computing Platforms: Infrastructure Builds for Tomorrow’s Data Centre
Integrated Computing Platforms, such as EMC VSPEX RAs, provide a solution by eliminating the time (and cost) of designing, testing, and engineering integrated environments with components built independently of one another. These validated architectures are ready for production environments upon delivery, and offer a single point of support should IT require it. Learn more on how a leading IT vendor has aligned product innovation with an IT market need to improve efficiency, performance, and value for SMBs.