MySpace Users Have Stronger Passwords Than Employees

Ant writes "A Wired News column reports on Bruce Schneier's analysis of data from a successful phishing attack on MySpace, and compares the captured user-passwords to an earlier data-set from a corporation. He concludes that MySpace users are better at coming up with good passwords than corporate drones." From the article: "We used to quip that 'password' is the most common password. Now it's 'password1.' Who said users haven't learned anything about security? But seriously, passwords are getting better. I'm impressed that less than 4 percent were dictionary words and that the great majority were at least alphanumeric. Writing in 1989, Daniel Klein was able to crack (.gz) 24 percent of his sample passwords with a small dictionary of just 63,000 words, and found that the average password was 6.4 characters long."

Password1?

[spun]

That's the kind of password an idiot would have on his electronic luggage!

The three most commonly used passwords are...

[Pojut]

"Love, Sexxxx, and...GOD. So, would her royal highness care to change her password?"

Security through obscurity?

[GoodbyeBlueSky1]

...found that the average password was 6.4 characters long.

What kind of newfangled keyboard do you need to type one of those in?!

nobody can guess mine

[zakeria]

I use this password ;#E4][££2&9a for everything.. Oops?

i'm not suprised

[JeanBaptiste]

a 14 year old cares far more about their social life than most adults care about their jobs.

You're ignoring the obvious

[neimon]

How do you get .4 characters? What's 2/5 of 8 bits? 16/5? That's so kewel. NO one will guess that.

password1???

[Rob T Firefly]

Amazing! That's the same password I have on my luggage!

Re:Okay...

[Anonymous Coward]

Wow. We MySpace usrz hav BetA security. hu wouldve thunk it. It's not lIk Im doin NEthing dfrnt. Im not lIk tinkN security 24-7.

This is all wrong...

[__aaclcg7560]

MySpace passwords would fail more often if a l33t dictionary was used instead. Do kids even know words from a plain old dictionary?

Re:nobody can guess mine

[kaizenfury7]

Don't worry... all we saw was:

I use this password ************ for everything.. Oops?

Slashcode is pretty advanced like that... it has filters that automatically hide your personal information in case you accidentally post it. Try posting your ATM PIN or social security code and see how advanced those filters are.

Dictionary words?

[chrisb33]

I'm impressed that less than 4 percent were dictionary words

Considering only 10 percent of the words on myspace are dictionary words to begin with, this isn't very surprising.

Maybe the users just used their usernames as passwords - that would probably be the best way to generate a random sequence of characters.

It's obvious!

[AntEater]

Of course dictionary attacks won't work - have you seen the spelling on MySpace?!? It's not that they are trying to be more secure, it's that the users can't spell well enough to get a dictionary match.

Getoffamylawn!

Re:Okay...

[Brewskibrew]

Hello, this is http://slashdot.org./ [slashdot.org.] We're undergoing a routine security check and your account has been flagged as it is being accessed by computers in other countries. Please click "reply" to this post and enter your userid, password, shoe size, and iq so that your account can be unlocked. Failure to do so indicates that you are a non-compliant individual and appropriate steps will be taken.

Re:Security through obscurity?

[kaizenfury7]

You need to use an average keyboard because an average keyboard has 101.4 keys.

Re:nobody can guess mine

[Tired_Blood]

Don't worry... all we saw was:

I use this password ************ for everything.. Oops?

Slashcode is pretty advanced like that... it has filters that automatically hide your personal information in case you accidentally post it. Try posting your ATM PIN or social security code and see how advanced those filters are.

"you can go hunter2 my hunter2-ing hunter2"

*Cough* [bash.org]

Re:Password1?

[0kComputer]

/obligitory That's the same combination I have on my luggage!

.gz?

[mattpointblank]

Writing in 1989, Daniel Klein was able to crack (.gz) 24 percent of his sample

I love when the editors just copy and paste without even reading what they're posting. Which part of that sentence was a .gz file, Zonk?

Re:Duh!

[Anonymous Coward]

Those corporate users that were dumb enough to fall for phishing had bad passwords. No suprises there. People prone to fishing are probably less securtity concious.

People prone to fishing are probably fish.

Re:Okay...

[ceoyoyo]

Maybe MySpace users just can't spell....

Excellent Security

[Namlak]

found that the average password was 6.4 characters long

6.4 character-long passwords are extremely secure!

Every password-cracking scheme that I've seen goes right from 6 character strings to 7 character strings.

Re:Okay...

[Dabido]

You're going to have trouble typing my password, as it's 6.4 characters long. The first six characters are 'passwo' The .4 consists of 'r' and 'd' type in such a way as to only use 0.2 of each. :-)