SAN FRANCISCO — For 333 people who used “ninja” as a password for Yahoo Mail or another Web service, Thursday was the day their fleet-footed, black-clad cover was blown.
A group of hackers calling itself “the D33Ds Company” published a list of 453,492 email addresses and passwords in plain text on Thursday, saying they had found them by hacking into a database associated with an unnamed Yahoo service. The passwords weren’t all for Yahoo services; they also come from domain names including gmail.com, hotmail.com and aol.com.
A look through the compromised account information says a lot about Web users and security: First of all, a lot of them don’t have much of it.
The most common password in the list is “123456,” a simple jaunt across the keyboard that was used for 1,673 of the accounts. Another popular option was “##########,” which 1,279 users chose. The fact that this password is longer and utilizes non-alphanumeric characters, both of which are common recommendations from password experts, shouldn’t really make those 1,279 people rest easier.
Then again, 804 users faced with having to create a username and password for their private information promptly entered “password.” More than 500 others started their passwords with “password,” giving hackers a nice head start.
The antiquated username-password method of online authentication deserves some of the blame for weak protection. Users forced to come up with one more unique combination of letters, numbers and punctuation, then periodically change it, get frustrated for good reason. The passwords revealed on Thursday included “dontforget” on six accounts. One weary user created, “dontforgetdummy.” Seventeen others came up with a reminder and password all rolled into one: “changeme.”
Looking for a way out, a few inevitably looked to the bottle. Boozy passwords included, “beerisgood,” “beer4me,” “beertime” and simply, “alcohol” — chosen by four people. Religion is another major theme: “jesus” appears 40 times, while the slightly more protective “jesus1” is the password on 101 accounts.
Eventually, along with the frustrations of setting up an online account comes the other end of it. Not one but two of the accounts revealed on Thursday used the password, “accountclosedpissoff.”