{"id":35833,"date":"2020-07-01T15:09:00","date_gmt":"2020-07-01T15:09:00","guid":{"rendered":"http:\/\/dd619779-81b6-434c-b398-ab4c7ca58799"},"modified":"2020-07-01T15:09:00","modified_gmt":"2020-07-01T15:09:00","slug":"one-out-of-every-142-passwords-is-123456","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/one-out-of-every-142-passwords-is-123456\/","title":{"rendered":"One out of every 142 passwords is ‘123456’"},"content":{"rendered":"

\"stop-using-123456-as-your-password-thumb.jpg\"<\/span><\/p>\n

In one of the biggest password re-use studies of its kind, an analysis of more than one billion leaked credentials has discovered that one out of every 142 passwords is the classic “123456” string.<\/p>\n

The study, carried out last month by computer engineering student Ata Hak\u00e7\u0131l, analyzed username and password combinations that leaked online after data breaches at various companies.<\/p>\n

These “data dumps” have been around for more than half a decade, and have been piling up as new companies are getting hacked.<\/p>\n

The data dumps are easily available online, on sites like GitHub or GitLab, or freely distributed via hacking forums and file-sharing portals.<\/p>\n

Over the years, tech companies have been collecting these data dumps. For example, Google, Microsoft, and Apple, have collected leaked credentials to create in-house alert systems that warn users when they’re utilizing a “weak” or “common” password.<\/p>\n

Furthermore, the Have I Been Pwned online service also works on top of these leaked data dumps and credentials.<\/p>\n

Study results<\/h3>\n

Last month, Hak\u00e7\u0131l, a Turkish student studying at a university in Cyprus, downloaded and analyzed more than one billion leaked credentials.<\/p>\n

\n<\/section>\n

The main discovery was that the 1,000,000,000+ credentials dataset included only 168,919,919 unique passwords, of which more than 7 million were the “123456” string.<\/p>\n

This means that one out of every 142 passwords included in the sample Hak\u00e7\u0131l analyzed was the weakest password known today — with the “123456” string being the most commonly reused password online for the past five years in a row, and counting.<\/p>\n

In addition, Hak\u00e7\u0131l also discovered that the average password length is usually of 9.48 characters, which isn’t good, but isn’t terrible either, as most security experts recommend using passwords as long as possible, and usually in the realm of 16 to 24 characters, or more.<\/p>\n

But password length was not the only issue Hak\u00e7\u0131l discovered. The Turkish researcher said that password complexity was also a problem, with only 12% of the passwords containing a special character.<\/p>\n

In most cases, users chose simplistic passwords such as using only letters (29%) or numbers (13%). This meant that around 42% of all the passwords included in the 1 billion dataset were vulnerable to quick dictionary attacks that would allow threat actors to gain access to accounts without any effort or technical difficulty.<\/p>\n

The study’s full results are available on GitHub<\/a>, with a short summary below:<\/p>\n