What is the most popular password?

David Heath
Friday, 22 January 2010 07:22

Business IT - Security

Strangely, it's not 'password.'

Following the announcement of an attack at RockYou.com whereby a hacker managed to obtain all the account details of 32M users, the security companies have had fun analyzing the data.  It appears that the hacker only shared the actual passwords, not the accompanying account information, but that was probably just to keep the useful stuff to themselves.  There was a website featuring all the passwords, but this has now been taken off-line.

Imperva is one such company and their summary makes for interesting reading.

Close to 1% of all accounts at RockYou used 123456 as their passwords.  That's 290,731 accounts out of 32M.

The remainder of the top 20 are as follows:

Rank	Password	Number of Users   with Password
1	123456	290731
2	12345	79078
3	123456789	76790
4	Password	61958
5	iloveyou	51622
6	princess	35231
7	rockyou	22588
8	1234567	21726
9	12345678	20553
10	abc123	17542
11	Nicole	17168
12	Daniel	16409
13	babygirl	16094
14	monkey	15294
15	Jessica	15162
16	Lovely	14950
17	michael	14898
18	Ashley	14329
19	654321	13984
20	Qwerty	13856

  
 The Imperva report notes that "Almost all of the 5000 most popular passwords, that are used by a share of 20% of the users, were names, slang words, dictionary words or trivial passwords."  Imperva also noted that just 4% of passwords used any kind of 'special' character.  In fact around 60% of the passwords were drawn from the set of lower-case letters and digits.

This is probably the first-ever study of a large set of "in the wild" passwords; most previous studies were based on surveys – ranging from the infamous Liverpool St Station chocolate swap to a variety of more 'competent' assessments.

Interestingly, many of these surveys have pointed to 'password' as being more prevalent than the Imperva study has revealed.

One final observation.  Being what is essentially a "throw-away" site, it would be reasonable to assume that many people have used a very simple password whereas they would use more complex passwords where it mattered more. 

Hopefully!