"123456" has once again topped an annual list of the worst passwords created by users in North America and Western Europe. On 19 December, password management provider SplashData released the 2017 edition of its "Worst Passwords of the Year" list. The dataset comprises five million leaked passwords exposed by data security incidents over the course of the year. As reported by Time, the list does not include any credentials from the breach of all three billion Yahoo users' accounts, a compromise which originally occurred in 2013 but the full extent of which emerged in October 2017. Consistent with the past three years' lists, "123456" came in as the worst password used by people living in North America and Western Europe for 2017. Keeper Security's list for 2016 saw "password" register at eighth place. However, SplashData's 2017 compilation reveals that "password" is still (or once again) at Number 2. It got there by beating out other abhorrent password choices including "12345678," "qwerty," and "letmein." Further on down the list, we find some basic alphanumeric combinations, such as "abc123" at Number 15, "trustno1" at Number 25, and "jordan23" at Number 27. There are also plenty of choices like "freedom," "dragon," and even "starwars" that attackers could easily crack using a dictionary-based brute force attack. Here are the 25 worst passwords on SplashData's 2017 list:
- 123456
- Password
- 12345678
- qwerty
- 12345
- 123456789
- letmein
- 1234567
- football
- iloveyou
- admin
- welcome
- monkey
- login
- abc123
- starwars
- 123123
- dragon
- passw0rd
- master
- hello
- freedom
- whatever
- qazwsx
- trustno1
Moral of the story? Many users can still benefit from practicing better password security. They can learn how to do so by following these experts' advice. Once they have those recommendations figured out, they can consider implementing additional security measures like multi-factor authentication (MFA), which is a key step for implementing one of the Center for Internet Security's (CIS) critical security controls (CSCs). You can learn about all 20 of the CSCs and how they work with Tripwire's solutions by clicking here.
