Those leaked email passwords...

Because we're all up to date with the 10,000+ Hotmail passwords that were leaked, and because we're already cognizant of the additional 20,000+ email passwords stolen from AOL, Yahoo, Gmail, I won't discuss it. Instead, someone has already examined all 10,000+ Hotmail passwords and culled some interesting facts about people and their passwords.

Top 10 passwords used:

1. 123456 - 64
   
2. 123456789 - 18
   
3. alejandra - 11
   
4. 111111 - 10
   
5. alberto - 9
   
6. tequiero - 9
   
7. alejandro - 9
   
8. 12345678 - 9
   
9. 1234567 - 8
   
10. estrella - 7
    

It appears that the phishing attack used, was either directed towards Spanish speakers or Spanish speakers are more vulnerable to phishing attacks by a possible lack of awareness. Of course, how lame is it to use a simple numeric progression password?

Just as fascinating, is the length of passwords used:

• 4 chars – 31 – 0 %
  
• 5 chars – 49 – 1 %
  
• 6 chars – 1946 – 22 %
  
• 7 chars – 1254 – 14 %
  
• 8 chars – 1838 – 21 %
  
• 9 chars – 1091 – 12 %
  
• 10 chars – 772 – 9 %
  
• 11 chars – 527 – 6 %
  
• 12 chars – 431 – 5 %
  
• 13 chars – 290 – 3 %
  
• 14 chars – 219 – 2 %
  
• 15 chars – 157 – 2 %
  
• 16 chars – 190 – 2 %
  
• 17 chars – 56 – 1 %
  
• 18 chars – 17 – 0 %
  

I suspect this prevalence of 6 through 9 character length passwords is due to the hotmail system that indicates the strength of your password (weak = less than 6 characters?). Of course, it has been said that most people can only remember 9 character strings in length.

Well, it turns out that LENGTH of password actually works better than COMPLEXITY. So don't be afraid to use a phrase that is very long but easily memorized, such as, "HeyILove2UseMyHotmailAccount" (note: don't use this example, as it's out in the open, now that I've published it publicly). Basically, choose something that can easily be replicated across all your password accounts, but is unique enough that no one will figure it out, and is long enough to make it difficult if not impossible for a brute force attack. Of course, you'll need to come up with two different pass phrases, as some websites have a lower limit of length of passwords (which is retarded).

- via CNET,Information Week, Acunetix and McAfee(Avert Labs)