If you or a loved one uses any of the passwords in this link, https://www.zdnet.com/article/these-are-the-most-commonly-hacked-passwords-and-theyre-embarrassingly-weak/, please change them immediately.
Hundreds of millions of internet users continue to put themselves at risk of having their accounts hacked by using incredibly simple and commonly used passwords which can easily be guessed by cyber criminals – or worse, just plucked from databases of stolen information.
An analysis of the 100,000 most common passwords made public by data breaches and hacking campaigns suggests that vast swathes of people still don’t understand the importance of having a strong password – or how to create one – using names, sports teams, bands and even just keys close together on the keyboard in an effort to secure accounts.
The passwords have been gathered using information from global data data breaches which are already in the public domain, having been leaked, shared or sold by hackers on the dark web.
The full list has been created and shared by the UK’s National Cyber Security Centre – the cyber arm of the GCHQ intelligence service – with the aim of encouraging users to create strong passwords to help protect sensitive data.
By far the most commonly used password revealed in data breaches is ‘123456’, with 23.2 million accounts using this password – made up of the first six numerical keys across the top of a keyboard; 7.7 million users went the whole hog and used almost all the numerical keys, opting to use ‘123456789’ as their password.
The remainder of the top five most commonly used passwords are each used by over 3 million users who’ve fallen data breaches – ‘qwerty’ appears 3.8m times, ‘password’ appears 3.6m times and ‘111111’ appears 3.1 million times.
Many of the top 50 most used passwords – almost all of which are used by over half a million people – are based around basic ideas, like being made up a simple series of numbers, or the same number repeated six or seven times.
Passwords ‘iloveyou’, ‘monkey’ and ‘dragon’ are among the top 20 most used, while ‘myspace1’ is ranked 26th on the list with 735,980 users selecting it as their password – it’s likely that they selected this as their password for MySpace, even if many have long forgotten about their account on the early social network.
SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)
SEE: The secret to being a great spy agency in the 21st century: Incubating startups [TechRepublic]
A major problem with these simple passwords is that it’s incredibly likely that the users are using them across multiple accounts – meaning that if their email address and password are exposed in a breach they could easily be used to access other services they uses including social media and online shopping accounts.
The NCSC – which has released the password list ahead of it’s CYBERUK 2019 conference in Glasgow – recommends using three random words as a password.
The password list was created using breached usernames and passwords collected on Have I Been Pwned, a website by security expert Troy Hunt which allows users to check if their email address appears in major data breaches.
The NCSC has published advice on what makes a good password and how users can secure their accounts on the official NCSC website.