'123456' and 'Password' Remain Worst Passwords of the Year for Fifth Consecutive Year

[MacRumors]

SplashData published its annual list of the worst passwords of the year this week, sourced from more than five million passwords leaked on the internet this year. Like previous years, 2018 saw numerous high-profile data leaks, but many people have continued to use easily guessable passwords for their online accounts.

The new password autofill feature in iOS 12​

For the fifth consecutive year, "123456" and "password" are the top two most popular passwords online. New entries on the list include "111111", "sunshine", "princess", "666666", "654321", and "donald" at number 23. SplashData CEO Morgan Slain discussed the list: "Hackers have great success using celebrity names, terms from pop culture and sports, and simple keyboard patterns to break into accounts online because they know so many people are using those easy-to-remember combinations."

The top 10 most popular passwords of 2018:

1) 123456
2) password
3) 123456789
4) 12345678
5) 12345
6) 111111
7) 1234567
8) sunshine
9) qwerty
10) iloveyou

Higher up the list, popular passwords include people's names like "daniel", "hannah", and "thomas"; pop culture references like "solo", "tigger", and "lakers"; random items like "cookie" and "banana"; birth years like "1990" and "1991"; and simple phrases like "whatever" and "test". As Slain explained, using super-simple phrases like these for any account online is a bad idea because it's so easy to guess what they are.

"Our hope by publishing this list each year is to convince people to take steps to protect themselves online," says Slain. "It's a real head-scratcher that with all the risks known, and with so many highly publicized hacks such as Marriott and the National Republican Congressional Committee, that people continue putting themselves at such risk year-after-year."

In total, SplashData estimated that almost 10 percent of people have used at least one of the top 25 worst passwords on this year's list, and nearly 3 percent of people have used the worst password at one time, "123456". Most of the five million passwords that were leaked and evaluated for the report came from users in North America and Western Europe.

To help users stay safe, SplashData said that their passwords should be no shorter than twelve characters and have mixed types of characters in each one. Every log-in should have a different password, and investing in a password management app to store everything, generate random new passwords, and automatically log into websites is always a good idea.

Apple itself introduced a new password autofill feature in iOS 12 this year, making it easy to connect to third-party password apps and fill out your passwords throughout iOS. If you haven't tried it out yet, check out our guide on using the feature to find out how it works.

Article Link: '123456' and 'Password' Remain Worst Passwords of the Year for Fifth Consecutive Year

 

[bigboyz12000]

The "users" name is also a big one haha! Nothing like cryptic secure passwords.

 

[Claymore]

Quick, change the combination on my luggage! Yes got in there first

 

[Kanyay]

Thank god mine didn't make the list.

 

[supremedesigner]

I’m surprised JuMamma isn’t listed in there lol

 

[cableguy84]

My macrumors password is a combination of both

Password123456

 

[AngerDanger]

How are people managing to get away with such simple passwords? I take the XKCD approach to password creation—a sentence comprised of nonsensical but easy to remember words. By the time I get done setting up an account, however, I've had to add a number, a capital letter, and a symbol. They only make my originally strong password harder for me to remember.

 

[Dekema2]

I don't understand why people put the least amount of effort into securing the most vulnerable parts of their lives.

 

[fathergll]

hahah "princess". AKA high maintenance

 

[L-Viz]

I am always safe with the "user" "admin" combo

 

[yaxomoxay]

Mandatory video on password security:

 

[brofkand]

Free password managers like iCloud Keychain, Bitwarden, etc., make remembering passwords obsolete. There is no excuse to have poor passwords in 2018.
[doublepost=1544799583][/doublepost]

How are people managing to get away with such simple passwords? I take the XKCD approach to password creation—a sentence comprised of nonsensical but easy to remember words. By the time I get done setting up an account, however, I've had to add a number, a capital letter, and a symbol. They only make my originally strong password harder for me to remember.

That was great advice before the advent of cross platform secure password managers, but today I'd say using a password manager to generate a random high entropy password is a better solution, ideally coupled with a second factor for sensitive data like banking or sites with payment methods attached.

 

[bytethese]

Really happy and sad at the same time that two people beat me to the Spaceballs references.

 

[Junipr]

Older Coworkers: “I use one password for everything...”

Me: “Nice! 1Password is a great password management app”

OC: “No app, just the same password every time...”

Me: *facepalm*

 

[EdT]

The problem with the XKCD cartoon is companies saw his suggestion and wrote requirements for a valid password that mess up the idea. Such as, can’t have 2 numbers next to each other or they can’t be sequential or you must have one of a few specific characters in your password or you cannot have some characters etc.

 

[WannaGoMac]

How did they collect the counts to make this list?
Looks like they just came up with the list of passwords themselves, no actual survey or counting from password leaks.
FUD

 

[brofkand]

How did they collect the counts to make this list?
Looks like they just came up with the list of passwords themselves, no actual survey or counting from password leaks.
FUD

It's discussed in the article MacRumors linked to. In the first few sentences no less.

 

[tromboneaholic]

With Face ID, my password is my face.
[doublepost=1544799995][/doublepost]

With Face ID, my password is my face.

Worst Password of the Year

 

[Xenomorph]

I know it's overused (and mentioned already in this thread), but the reference still manages to pop up with IT at work.

1, 2, 3, 4, 5? That's amazing! I've got the same combination on my luggage!

 

[WannaGoMac]

It's discussed in the article MacRumors linked to. In the first few sentences no less.

When I click the link all i see is an article list of 100 passwords with pictures making fun of them, then a video to play (which I refuse to do).


edit: Looks like macrumors changed the URL link as now it goes to an article and not the direct list.

p.s. What moron thought light grey text on a white page was a good idea?

 

[Parystec]

When I click the link all i see is an article list of 100 passwords with pictures making fun of them, then a video to play (which I refuse to do)

That was lucky. I had forgotten my passwords. Then found this list of all my 10 passwords

 

[mattopotamus]

Why people are not using an app with password generators confuses me.

 

[blacktape242]

Mandatory video on password security:

you beat me to it!

 

[MhaelK]

Huhuuuu, I won again - my password is number one on the list!!!

 

[NinjaHERO]

While I'd never use one of these passwords personally, I totally get some people's frustration. My job requires us to change multiple passwords every 3 months. At some point you get tired of making stuff up.