What's your password?

AuntPeggy

AuntPeggy

Final Approach
PoA Supporter
Joined
May 23, 2006
Messages
8,484
Location
Oklahoma
Display Name
Namaste
Home Airfield
OK93 (Airman Acres)
Here are the latest top 25. Is yours on the list?

1. password (Unchanged)
2, 123456 (Unchanged)
3. 12345678 (Unchanged)
4. abc123 (Up 1)
5. qwerty (Down 1)
6. monkey (Unchanged)
7. letmein (Up 1)
8. dragon (Up 2)
9. 111111 (Up 3)
10. baseball (Up 1)
11. iloveyou (Up 2)
12. trustno1 (Down 3)
13. 1234567 (Down 6)
14. sunshine (Up 1)
15. master (Down 1)
16. 123123 (Up 4)
17. welcome (New)
18. shadow (Up 1)
19. ashley (Down 3)
20. football (Up 5)
21. jesus (New)
22. michael (Up 2)
23. ninja (New)
24. mustang (New)
25. password1 (New)
 
I have maybe 25 places where I have to enter passwords. I have only two, but half of them must be changed every 30 days.
 
I thought the #1 password was the same as the username.....

And how come everyone's Samsonite combination isn't on there (0000)?
 
How come 1234 didn't make the list?
 
One of my passwords is "badpasswordsmakebabyjesuscry". It doesn't have a number or special character. It'll probably get hacked. :)
 
My grandmother has a password she never forgets. "incorrect"

That way whenever she enters anything in the password location, the computer tells her "The password is incorrect"

She alternates between "incorrect" and "forgotten"

Cheers
 
BTW, what's the source on that list? I mean, if our passwords are secret, how can anybody know what the top 25 really are?
 
how did you get all of my passwords? :)

I like the blond joke of

"MickeyMinniePlutoHueyLouieDeweyDonaldGoofySacramento"

(eight 'characters' and one 'capital')
 
That's amazing, I have the same combination on my luggage!
 
As for where the list comes from, security audits frequently include dictionary attacks against password files. The report shows the cracked passwords and their frequency. That's why systems ask for complex passwords nowadays.

Sent from my SCH-I200 using Tapatalk 2
 
I used to use the words in the upper right hand corner of the log in screen.

My bank password was "findalocation"
My PoA passwrod was "livechat"
My AOPA password was "submit"
etc.

Then I'd move to a different corner...
 
MAKG1 said:
You use a swear word for your password? :)
Click to expand...


Funny you should say that.......

For several years I used a cuss word : *uckyou.... It just got hacked about 2 months ago... No damage done to my accounts but I was amazed someone actually guessed it.:confused:
 
Many years ago when you had to log into WashingtonPost.com to read stuff on line, I tried entering [email protected] as my email but it was already taken, so I used [email protected]. Years later when I was cancelling my print subscription, the cs rep on the phone verified my identity and asked if my email was [email protected]. Boy I had forgotten I had done that (and how it got associated with my print subscription I do not know).
 
Love this xkcd comic on the subject of password strength:

password_strength.png
 
I use passwords made up from the stuff on the bookshelf near my desk...
 
I used to drive clients nuts with some of my WPA keys. I used sentences from books or plays, usually with one little change from the real deal. One that I used quite a bit was
When shall we three meet again?
​
Which is the first line of the Scottish Play, but truncated, and with the question mark moved up.

For a bedding store that had terminals in the showroom for customers to view marketing materials and salespeople to run credit apps, I used
To sleep: perchance to dream: ay, there's the rub.
​
Which, of course, is a line from Hamlet's Soliloquy, but with the semicolon at the end replaced by a period.

For an accountant who specialized in finding tax shelters to offset profits, I borrowed this line from Catch-22:
His prices were high, for failure often did not come easily.
​
Hey, sometimes you have to find fun where you can.

-Rich
 
N801BH said:
Funny you should say that.......

For several years I used a cuss word : *uckyou.... It just got hacked about 2 months ago... No damage done to my accounts but I was amazed someone actually guessed it.:confused:
Click to expand...

Hacker's rarely 'guess' passwords. They usually start with the list above, since those are the most common. Once that fails, they use something called a Brute Force attack (Assuming they do not have any type of keylogging software on your computer)

The way the BF attack works, is it starts with the minimum required length of the password, such as 7 characters. It tries every combination of letters. Such as the following:
aaaaaaa
aaaaaab
aaaaaac
......
baaaaaa
baaaaab
......
zzzzzzzz

This takes a considerable amount of time depending on the length of the password. If the minimum character limit doesn't work, they add one more character, and so on. For 7 characters, there's over 8 BILLION combinations of letters. For a computer, that takes a little while, maybe 30 minutes or so. That's assuming your whole password is lowercase. The second you add ONE uppercase letter, the number of combinations the hacker must try goes to over a Trillion, which takes hours. Add symbols, and you're up to days, if not weeks. That's assuming the website doesn't stop the attack in the progress.

Hopefully this will help those of you with simple passwords understand the importance of complex passwords. It's really only necessary for important accounts, such as email and bank accounts. You can use a simpler password for less important things, like social networks and whatnot.

I personally use a complex combination of letters and symbols for my passwords, but it's done in a manner I can easily remember. Let's say I soloed in a Cessna 172 with the tail number of N192PJ.

Cssna172&2PJsolo would be a good password.
 
janikpilot said:
Hacker's rarely 'guess' passwords. They usually start with the list above, since those are the most common. Once that fails, they use something called a Brute Force attack (Assuming they do not have any type of keylogging software on your computer)

The way the BF attack works, is it starts with the minimum required length of the password, such as 7 characters. It tries every combination of letters. Such as the following:
aaaaaaa
aaaaaab
aaaaaac
......
baaaaaa
baaaaab
......
zzzzzzzz

This takes a considerable amount of time depending on the length of the password. If the minimum character limit doesn't work, they add one more character, and so on. For 7 characters, there's over 8 BILLION combinations of letters. For a computer, that takes a little while, maybe 30 minutes or so. That's assuming your whole password is lowercase. The second you add ONE uppercase letter, the number of combinations the hacker must try goes to over a Trillion, which takes hours. Add symbols, and you're up to days, if not weeks. That's assuming the website doesn't stop the attack in the progress.

Hopefully this will help those of you with simple passwords understand the importance of complex passwords. It's really only necessary for important accounts, such as email and bank accounts. You can use a simpler password for less important things, like social networks and whatnot.

I personally use a complex combination of letters and symbols for my passwords, but it's done in a manner I can easily remember. Let's say I soloed in a Cessna 172 with the tail number of N192PJ.

Cssna172&2PJsolo would be a good password.
Click to expand...

The only thing that's more astonishing than the weak passwords some people choose is the fact that there are some server admins who do nothing to stop BF attacks. I think that ranks near the top in terms of negligence.

It can be a pain because users do forget their passwords and lock themselves out by repeated guessing (sometimes along with the rest of their companies, if they're using a shared public IP and are particularly stubborn). I also have email password resets disabled, so the users can't reset their own passwords.

But a little bit of education -- impressing upon users the importance of calling me or my backup for a reset rather than guessing more than the allotted number of tries -- prevents lock-outs most of the time.

-Rich
 
My current password is really a pattern that changes based on what I'm securing. It includes symbols and numbers and is longer than 8 characters.

What's really annoying is when a website either doesn't allow symbols, or limits you to only 8 characters.

What's scary is that 90% of the time those sites are banks or something I need to pay a bill online :yikes:
 
bluesky74656 said:
My current password is really a pattern that changes based on what I'm securing. It includes symbols and numbers and is longer than 8 characters.

What's really annoying is when a website either doesn't allow symbols, or limits you to only 8 characters.

What's scary is that 90% of the time those sites are banks or something I need to pay a bill online :yikes:
Click to expand...

I am just the opposite... I NEVER bank online or for that matter use my credit card online... If I can't call a human on the phone to order something then I don't buy it..:no:
 
N801BH said:
I am just the opposite... I NEVER bank online or for that matter use my credit card online... If I can't call a human on the phone to order something then I don't buy it..:no:
Click to expand...

Do you think that the call center employee making minimum wage is a safer bet than encrypted and anonymous electronic processing? All of the bogus charges I have had, and I have had a few, came from using my credit card at restaurants with a "human" involved.
 
John221us said:
Do you think that the call center employee making minimum wage is a safer bet than encrypted and anonymous electronic processing? All of the bogus charges I have had, and I have had a few, came from using my credit card at restaurants with a "human" involved.
Click to expand...

If the card gets hacked... I can pin it down to that vendor,, not the 1 billion con men living in tents in Africa.....
 
Last edited:
N801BH said:
If the card gets hacked... I can pin it down to that vendor,, not the 1 billion con men living in tents in Africa.....
Click to expand...

Nope, it was an employee of the vendor and all you can do is dispute the charge with your credit card company, which works great. They rarely, if ever, catch these guys (who, BTW, are selling the CC numbers to the con men in Africa or the Ukraine). It is much easier to make a copy of a physical card than to compromise credit cards from a large online processing company, An industry which is highly regulated and audited for security processes and systems. Do you stick your credit card into the gas pump to buy gas? How do you think that is processed? There was a case, locally, where a crook had installed devices on the gas pumps and was pilfering credit card numbers.
 
RJM62 said:
I also have email password resets disabled, so the users can't reset their own passwords.
Click to expand...
Rich, what's the rationale behind disabling email password resets? I think that they're much more secure than the silly "secret questions" that are used all too frequently, especially when you're forced to select from the vendor-supplied list of questions. In a situation where there is a desire for 24x7 usage, having to hire someone to be available to perform manual resets seems cost prohibitive, and opens up the possibility of social engineering cracks, too.
 
John221us said:
Nope, it was an employee of the vendor and all you can do is dispute the charge with your credit card company, which works great. They rarely, if ever, catch these guys (who, BTW, are selling the CC numbers to the con men in Africa or the Ukraine). It is much easier to make a copy of a physical card than to compromise credit cards from a large online processing company, An industry which is highly regulated and audited for security processes and systems. Do you stick your credit card into the gas pump to buy gas? How do you think that is processed? There was a case, locally, where a crook had installed devices on the gas pumps and was pilfering credit card numbers.
Click to expand...

My life is simpler then that.....

I use my card to pay NetZero monthly. And other then orders to Aircraft Spruce it does not get used.... I pay with cash or checks for all other stuff.
 
gprellwitz said:
Rich, what's the rationale behind disabling email password resets? I think that they're much more secure than the silly "secret questions" that are used all too frequently, especially when you're forced to select from the vendor-supplied list of questions. In a situation where there is a desire for 24x7 usage, having to hire someone to be available to perform manual resets seems cost prohibitive, and opens up the possibility of social engineering cracks, too.
Click to expand...

I'm semi-retired and have few enough clients that being available 24/7 to do password resets is not a big deal for me. Also, all of these clients have someone in their own company who is tech savvy and who has access to cPanel, and who actually is the go-to person for password resets (as well as creating new email accounts, deleting old ones, etc.). They only call me if that person isn't available. It happens maybe once or twice a year.

My backups are two of my brothers who have the root passwords to my servers, as well as other information they would need if I were to screw the pooch. In return for a share of my vast wealth :lol: when that day comes, they also theoretically do password resets if I go away for a few days in the meantime. Neither has happened yet.

-Rich
 
RJM62 said:
I'm semi-retired and have few enough clients that being available 24/7 to do password resets is not a big deal for me. Also, all of these clients have someone in their own company who is tech savvy and who has access to cPanel, and who actually is the go-to person for password resets (as well as creating new email accounts, deleting old ones, etc.). They only call me if that person isn't available. It happens maybe once or twice a year.

My backups are two of my brothers who have the root passwords to my servers, as well as other information they would need if I were to screw the pooch. In return for a share of my vast wealth :lol: when that day comes, they also theoretically do password resets if I go away for a few days in the meantime. Neither has happened yet.

-Rich
Click to expand...
Okay, makes sense! I've got about 40,000 students to forget their passwords. I want to make it as hands-off as possible for us while still maintaining security!
 
You must log in or register to reply here.
Back
Top