123456 That's My Number

[Lockjaw]

.... but 123456 is my mother's maiden name!

 

© Rob Whale 2012.

[barleycorn]

There's a couple of XKCDs for that...

 

http://xkcd.com/936/

http://xkcd.com/792/

 

jb

[alchresearch]

There's a new XKCD for this Adobe issue:

 

http://xkcd.com/1286/

[barleycorn]

There's a new XKCD for this Adobe issue:

 

http://xkcd.com/1286/

 

Yeah saw that. Didn't understand it.

 

jb

[rickiethecat]

That's the most common password according to Adobe.

 

Other common ones include 123456789 and 1234567.

 

Are you using stupidly simple passwords, or do you have a more sophisticated technique for managing all of your online stuff?

 

I use the same password for all the websites I'm registered on. I couldn't really care less about anyone guesing or using it. What's the worst that can happen - someone impersonating me on a forum? Big deal.

[barleycorn]

I use the same password for all the websites I'm registered on. I couldn't really care less about anyone guesing or using it. What's the worst that can happen - someone impersonating me on a forum? Big deal.

 

Depends on whether you use the same password for online banking.

 

jb

[rickiethecat]

Depends on whether you use the same password for online banking.

 

jb

 

I don't! I've heard so many horror stories about online banking that it sounds about as secure as shouting out your credit card details in the street.

[Jeffrey Shaw]

NB: newspapers' "hacking of mobile telephones"- the subject of court cases at present- was not that but hacking of mobile telephone voicemails that owners had failed to protect by simply changing the factory's pre-set password.

[HbroChris]

Yeah saw that. Didn't understand it.

 

jb

 

I would suggest http://www.explainxkcd.com/wiki/index.php?title=1286

 

I sometime resort to it for the more arcane ones.

 

I think the point here is that Adobe used a dodgy implementation of block encryption (where each block of 8 characters gets its own block of cipher-text) and also stored password hints in a relatively easily recoverable form, so that if you have encrypted passwords thus:

 

[aaaaaaaaaa] [bbbbbbbbb]

[aaaaaaaaaa] [ccccccccc]

 

and the hints are "owls" and "dad's favourite team" then while you can't solve the second one easily without the first, once you know that [aaaaa...] is "Sheffield" you know that [bbbbbb...] is clearly "wednesday" and can therefore infer that [ccc...] is probably "united" and thus guess user 2's password. Which is why it's kind of like one of those giant logic puzzles.

 

If you do this with enough encrypted accounts then you can make logical guesses about some very complex passwords based on some very simple ones.

 

It works because in the Adobe encryption implementation "Sheffield" would always result in the same encrypted block at the start of a password for each user (well, sort of, it's actually blocks of 8 characters, but the analogy works).

[Super Hans]

I use the same password for all the websites I'm registered on. I couldn't really care less about anyone guesing or using it. What's the worst that can happen - someone impersonating me on a forum? Big deal.

 

Totally agree with that.

 

When it comes to banking and stuff, fine...have a secure password.

 

But it really does my head in when you have to have a very 'secure' password for accounts that don't matter, with letters and capitals and numbers and punctuation and everything in.

 

As you say, if someone...can even be bothered to log out as themselves and log in as you, what's the worst that can happen?

 

Luckily SF is pretty relaxed on passwords.