Is your password on the list of 'worst passwords?' Here's how to change that.

A newly released list of most popular passwords shows 3 percent of Americans are putting their Internet security at the mercy of a password as simple as '123456.'

David Loh/Reuters
Social networking site LinkedIn and online dating service eHarmony warned that some user passwords had been breached after security experts discovered scrambled files with passwords for millions of online accounts, showing a need for users to have multiple, strong passwords.
Evolve IP
This cartoon is from Evolve IP, a cloud services company, at EvolveIP.net.

We put a man on the moon, but "password" is still the second-most common password on the Internet.

The annual list of America's "worst passwords" reveals the 25 most-popular – and therefore most easily guessed by hackers – passwords, according to SplashData.

The most-used password is the immortal "123456" followed by "password." About 3 percent of Americans risk their Internet security by using one of the top 25 passwords, although the number of people using popular passwords has gone down since 2011, according to TeamsID.

Several new additions to the top-25 list show that while familiarity with pop culture references might be a good social practice, it is no friend to Internet security. The passwords "princess," "solo," and "starwars" were newcomers to the list of most popular passwords. 

"We have seen an effort by many people to be more secure by adding characters to passwords, but if these longer passwords are based on simple patterns they will put you in just as much risk of having your identity stolen by hackers,” Morgan Slain, chief executive officer of SplashData, maker of TeamsID password manager, said in a press release. “As we see on the list, using common sports and pop culture terms is also a bad idea."

The password issue is a significant one because as more information goes online, the risks of identity theft become greater.

"It’s almost inevitable that some of your logins somewhere will be exposed," Mr. Slain wrote on the TeamsID blog. "You just want to make sure that exposure doesn’t have a cascading effect on your other logins, especially at more valuable sites and services (e.g., email and financial services)."

The California-based SplashData recommends a password or passphrase at least 12 characters long with a mix of letters, numbers, and special characters. The Department of Homeland Security recommends using a passphrase, such as this example from Microsoft Safety & Security Center:

Start with a sentence or two. Complex passwords are safer. Remove the spaces between the words in the sentence. Complexpasswordsaresafer. Turn words into shorthand or intentionally misspell a word. ComplekspasswordsRsafer. Add length with numbers. Put numbers that are meaningful to you after the sentence. ComplekspasswordsRsafer2011.

Trying to remember a handful of complex passwords could tempt even a savvy password-creator to resort to a sticky note on the computer screen. The alternative recommended by Homeland Security is a password manager.

Password managers can file the passwords into a single computer's hard drive; others plug into an Internet browser and save passwords in the cloud. Some generate lengthy, complex passwords automatically or provide a way for a designated heir to access web accounts in case of death. SplashData recommends it's own product TeamsID, but there are many other options available. The ideal password manager depends on the user, but PC Magazine created and reviewed a list of reliable password managers, sorted by price.

"For your own sanity and security, install a password manager and change all of your passwords so every single one is different, and every single one is long and hard to crack," Neil J. Rubenking wrote for PC Magazine.

You've read  of  free articles. Subscribe to continue.

Dear Reader,

About a year ago, I happened upon this statement about the Monitor in the Harvard Business Review – under the charming heading of “do things that don’t interest you”:

“Many things that end up” being meaningful, writes social scientist Joseph Grenny, “have come from conference workshops, articles, or online videos that began as a chore and ended with an insight. My work in Kenya, for example, was heavily influenced by a Christian Science Monitor article I had forced myself to read 10 years earlier. Sometimes, we call things ‘boring’ simply because they lie outside the box we are currently in.”

If you were to come up with a punchline to a joke about the Monitor, that would probably be it. We’re seen as being global, fair, insightful, and perhaps a bit too earnest. We’re the bran muffin of journalism.

But you know what? We change lives. And I’m going to argue that we change lives precisely because we force open that too-small box that most human beings think they live in.

The Monitor is a peculiar little publication that’s hard for the world to figure out. We’re run by a church, but we’re not only for church members and we’re not about converting people. We’re known as being fair even as the world becomes as polarized as at any time since the newspaper’s founding in 1908.

We have a mission beyond circulation, we want to bridge divides. We’re about kicking down the door of thought everywhere and saying, “You are bigger and more capable than you realize. And we can prove it.”

If you’re looking for bran muffin journalism, you can subscribe to the Monitor for $15. You’ll get the Monitor Weekly magazine, the Monitor Daily email, and unlimited access to CSMonitor.com.