It is a hacker’s dream. Even in the face of repeated warnings to protect online accounts, a new study reveals that “admin” is the most commonly used password in the UK.
The second most popular, “123456”, is also unlikely to keep hackers at bay.
It’s not just a problem here – Australians, Americans and Germans also use “admin” more than any other password when accessing websites, apps and logging in to their computers. Around the world, “123456” emerges as the most popular.
31 Comments
Dagnet@lemmy.world · 43 pts · 242d
Luckily for me my password is ******
Edit: weird lemmy automatically replaced my password with '*'
lemmyng@piefed.ca · 49 pts · 242d
Huh, let me try: hunter2
Dagnet@lemmy.world · 26 pts · 242d
It really works! I only see ******* !
prole@lemmy.blahaj.zone · 15 pts · 242d
Classic
JargonWagon@lemmy.world · 5 pts · 242d
Got 'em!
7U5K3N@lemmy.dbzer0.com · 30 pts · 242d
That's what I use on my luggage
frongt@lemmy.zip · 18 pts · 242d
You should enable MFA on your luggage
7U5K3N@lemmy.dbzer0.com · 3 pts · 242d
You know you say that more than likely in jest....
But that's honestly not a terrible idea.
frongt@lemmy.zip · 7 pts · 242d
No, it is a terrible idea. The lock is not the weak point on the luggage, it's the zipper.
MonkeMischief@lemmy.today · 3 pts · 242d
Overall I think the weakest part of luggage is its unusually high liklihood of attack by state adversaries. :p
7U5K3N@lemmy.dbzer0.com · 2 pts · 242d
That's very true! That zipper makes a great case for hard luggage that clamps closed.
Pelican I think makes really good luggage but with pelican comes the cost.
Railcar8095@lemmy.world · 8 pts · 242d
6 digits for luggage?
7U5K3N@lemmy.dbzer0.com · 13 pts · 242d
12345 was made popular by a documentary several years ago. So I updated my luggage.
/s
Railcar8095@lemmy.world · 9 pts · 242d
I was out of the loop, thanks for the clarification.
markz@suppo.fi · 23 pts · 242d
Don't use shit passwords. Don't reuse passwords. Get a password manager. Use 2fa.
not_me@piefed.social · 7 pts · 242d
deranger@sh.itjust.works · 1 pts · 242d
The more factors, the less secure. Each one you add is another potential exploitable authentication method. It’s only as secure as the least secure MFA method you add.
jj4211@lemmy.world · 1 pts · 242d
I mean, how many factors do you advocate for? Two is generally plenty as long as they are good ones.
E.g a passphrase protected ssh key is solid. Similarly protected passkey is good. A TOTP with password is... Not terrible I suppose... SMS would be pretty bad...
Danquebec@sh.itjust.works · 1 pts · 241d
I reuse passwords on sites where I don't care if my account gets breached.
On sites where it matters, I store them in a password manager.
On sites where money is managed, I keep the passwords only in my mind.
HC4L@lemmy.world · 1 pts · 242d
Online or offline password manager?
Fizz@lemmy.nz · 2 pts · 242d
Either or as long as theyre stored encrypted and decrypted on device.
shalafi@lemmy.world · 19 pts · 242d
Picked up a keyboard at the thrift with a pink sticky note on the bottom:
user:adminpass:passwordYes, someone had to write that down.
goferking0@lemmy.sdf.org · 4 pts · 242d
I'm their defense sometimes you have to be reminded that something that terrible was used
Kyrgizion@lemmy.world · 12 pts · 242d
I've "hacked" web apps by logging in with "user - password" or something equally inane.
kaitco@lemmy.world · 9 pts · 242d
But, my long-time sole password of TrustNo1 should be good right??
FordBeeblebrox@lemmy.world · 4 pts · 242d
Correct Horse Battery Staple
realitista@lemmus.org · 3 pts · 241d
I only came for the list of most popular passwords. I am disappointed.
Jimbabwe@lemmy.world · -4 pts · 242d
Invent your own hashing algorithm. It’s easy, fool-proof, secure, and reusable without compromising security.
Here’s a few examples: ebay.com password is moc.y4b3-saltyboi69 lemmy.world password is dlr0w.ymm3l-saltyboi69
(These aren’t real btw)
Jumuta@sh.itjust.works · 2 pts · 242d
people writing password crackers are smarter than that dude
Zaktor@sopuli.xyz · 4 pts · 242d
Most compromised passwords are used by script kiddies in mass attacks, not targeted attacks by elite hacking squads. If a password fails verbatim, they just move on to the next compromised account of millions, not develop pattern recognition software to try to figure out replacement candidates for each website.
Jumuta@sh.itjust.works · 1 pts · 241d
Association attacks exist in the wild.
Let's say that this is their ebay account. In that case the reward for unlocking each account is very high, so attackers (even in mass attacks) have incentive to put in more work as long as the work cost per account hacked is less than the average reward and there is a net profit.
I assume in this day and age it's probably also viable to use LLMs for password guessing, as long as it's for a high value account. That unlocks a whole another can of worms and if it was me I'd never use low entropy passwords like "moc.y4b3-saltyboi69"
Perhaps this kind of password is viable if it's for an online service that implements rate limiting, but you also have to consider the case that a site gets hacked and their encrypted database (encrypted by each user's password) makes it onto the web. This has happened a lot recently and makes it ridiculously easy for people to throw their GPUs at the task.
Jimbabwe@lemmy.world · 0 pts · 242d
You sound pretty unqualified to judge smartness.