Pierluigi Paganini December 27, 2017

For the second year in a row, “123456” was the top password found in data dumps in 2017 despite the numerous warning of using strong passwords.

For the second year in a row, “123456” was the top password among the millions of passwords exposed online due to the numerous data breaches suffered by organizations and private firms.

This is the sixth annual Worst Passwords report, the list was published by researchers at SplashData who analyzed more than five million user records containing passwords that were leaked online in 2017.

“Use of any of the passwords on this list would put users at grave risk for identity theft,” said a SplashData spokesperson in a press release.

Users continue to use simple numerical passwords, five of the top 10 passwords on this year’s list are composed of numbers only.

Below the list of the Top 10 passwords extracted from the SplashData report.

1 – 123456 (rank unchanged since 2016 list)
2 – password (unchanged)
3 – 12345678 (up 1)
4 – qwerty (Up 2)
5 – 12345 (Down 2)
6 – 123456789 (New)
7 – letmein (New)
8 – 1234567 (Unchanged)
9 – football (Down 4)
10 – iloveyou (New)

The list of Top 100 Worst Passwords of 2017 is embarrassing, it includes a huge number of sports terms (i.e. football, baseball, soccer)and car brands (i.e. Corvette, Ferrari).

Users continue to use common names as their passwords, names like of Robert (#31), Matthew (#32), Jordan (#33), Daniel (#35) and many others continue to be widely used.

Top passwords are the basic components of lists used by hackers in brute force attacks based on dictionaries. Attackers will use the Top password list also to create common variations on these words using simple algorithms, for example by adding a digit or any other character combinations at the start or end of words.

“Making minor modifications to an easily guessable password does not make it secure, and hackers will take advantage of these tendencies,” says Morgan Slain, CEO of SplashData, Inc. “Our hope is that by researching and putting out this list each year, people will realize how risky it is to use these common logins, and they will take steps to strengthen their passwords and use different passwords for different websites.”

Despite the numerous report published by the experts, users continue to adopt weak passwords and tend to reuse them to access several web services.

Pierluigi Paganini

(Security Affairs – Top password, data breaches)

[adrotate banner=”5″]

[adrotate banner=”13″]