For 333 people who used “ninja” as a password for Yahoo Mail or another Web service, Thursday was the day their fleet-footed, black-clad cover was blown.
A group of hackers calling itself “the D33Ds Company” published a list of 453,492 email addresses and passwords in plain text on Thursday, saying they had found them by hacking into a database associated with an unnamed Yahoo service. The passwords weren’t all for Yahoo services; they also come from domain names including gmail.com, hotmail.com and aol.com.
A look through the compromised account information says a lot about Web users and security: First of all, a lot of them don’t have much of it.
The most common password in the list is “123456,” a simple jaunt across the keyboard that was used for 1,673 of the accounts. Another popular option was “##########,” which 1,279 users chose. The fact that this password is longer and utilizes non-alphanumeric characters, both of which are common recommendations from password experts, shouldn’t really make those 1,279 people rest easier.
Then again, 804 users faced with having to create a username and password for their private information promptly entered “password.” More than 500 others started their passwords with “password,” giving hackers a nice head start.
However, password hackers have been warned: “donthack,” “donthackme,” and “dontdoit” are timely reminders to anyone who wants to use a cracking mechanism that runs through the lowercase alphabet. One accountholder was more vehement: “dontdoit!” the password warned.
The antiquated username-password method of online authentication deserves some of the blame for weak protection. Users forced to come up with one more unique combination of letters, numbers and punctuation, then periodically change it, get frustrated for good reason. The passwords revealed on Thursday included “dontforget” on six accounts. One weary user created, “dontforgetdummy.” Seventeen others came up with a reminder and password all rolled into one: “changeme.”
Passwords are also a window into the ups and downs of Internet life. Though one account holder declared in his password, “iamhappyalways,” and five chose, “iamgreat,” there were five with “lifesucks,” and a heartfelt, “lifesucksman.” Eight chose simply, “sorrow.” Seven users told the sign-up process to “gotohell,” though one chose, “gotoheaven.”
Looking for a way out, a few inevitably looked to the bottle. Boozy passwords included, “beerisgood,” “beer4me,” “beertime” and simply, “alcohol” — chosen by four people. Religion is another major theme: “jesus” appears 40 times, while the slightly more protective “jesus1” is the password on 101 accounts.
Eventually, along with the frustrations of setting up an online account comes the other end of it. Not one but two of the accounts revealed on Thursday used the password, “accountclosedpissoff.”
Stephen Lawson covers mobile, storage and networking technologies for The IDG News Service. Follow Stephen on Twitter at @sdlawsonmedia. Stephen’s e-mail address is stephen_lawson@idg.com