You definitely don’t want to be using these

  • Lenny@lemmy.zip
    6·
    1 month ago

    I see password and password1

    Mfw I’m sittin’ safe all the way down here at password69 😎

    • Cousin Mose@lemmy.hogru.ch
      5·
      1 month ago

      From my experience brute forcing passwords, no. It’s smart enough to try character substitutions and it annoys me so much that the FBI recommends this practice.

      • psx_crab@lemmy.zipEnglish
        2·
        1 month ago

        Wait it’s not? I remember some people in the industry recommend this sort of password albeit with variation of other random words as it’s pretty strong and would take a very long time to crack.

        • locuester@lemmy.zipEnglish
          3·
          1 month ago

          Indeed, just four impersonal words is a great password. Mix up the capitalization and it’s even better.

        • Cousin Mose@lemmy.hogru.ch
          22·
          1 month ago

          If it’s a bunch of words found in any dictionary then with or without character substitution it’ll be easy to crack.

          • itslilith@lemmy.blahaj.zone
            2·
            1 month ago

            It’s not. A dictionary has on the order of ≈100,000 (10^5) words in it. Picking five words entirely at random gives you 10^25 combinations, which is about the complexity of 14 alphanumeric characters. So pretty secure.

      • psx_crab@lemmy.zipEnglish
        2·
        1 month ago

        Need your credit card number and the 3 digit number at the back of the card to see what i typed.

    • itslilith@lemmy.blahaj.zone
      2·
      1 month ago

      That’s okay at best. Better if a passphrase, just random, impersonal words, something like this (~50 bits of entropy):

      “virtual raging vineyard clad runner”

      Best is a long, completely random string, stored in the password manager that you should be using anyways ~150 bits of entropy):

      “hX0hZ1QTWtQo(h[Ta9jH]TmsVIhUTgSE”

      • psx_crab@lemmy.zipEnglish
        1·
        1 month ago

        I did use a password manager, but issue is i still need password for the password manager so it can’t be random lol.

  • sga@lemmings.worldEnglish
    4·
    1 month ago

    I am really surprised some common shit is not there, like hello, hello1234, abcd1234 (and other perms have numbers in front, etc)

  • IllNess@infosec.pub
    3·
    1 month ago

    Hackers (1995) taught me the four most commonly used passwords are “love”, “sex”, “'secret”, and “god”.

    “secret” is there. “iloveyou” has love in it.

    I wonder how true that actually was in the 90s.

    • lemmyng@piefed.caEnglish
      4·
      1 month ago

      Before password composition rules, those were actually quite common, as well as passwords that were just the same as the username. Heck, it wasn’t until that long ago that router manufacturers used to ship with admin/admin as the default credentials.

      • Ptsf@lemmy.world
        2·
        1 month ago

        Honestly every networking company that couldn’t be bothered to ship with randomized creds physically embedded/etched somewhere on the device should’ve probably went out of business. The cost has always been minimal and the increased security value has always been readily apparent.

  • who@feddit.orgEnglish
    2·
    1 month ago

    I’m a little surprised not to see “changeme” on this list.

  • ns1@feddit.ukEnglish
    2·
    1 month ago

    Strange how much higher the top one, 123456, is than the others, and how the most popular ones with repeating numbers also have 6 digits. Why do people like 6 digits so much more than 5 or 7?

    • emb@lemmy.world
      1·
      1 month ago

      Because of composition rules. Fewer characters, much easier to brute force guess.

      So when a site tells you ‘Your password must be at least 6 characters long’, and they just want to get past it to get to the content, the number is already on their mind.