The 25 Worst Passwords Of 2018: Cybersecurity Firm Reveals

A cybersecurity firm has revealed the most hacked passwords of 2018 and the top offender is ‘123456’ followed by ‘password’ for the fifth year running.

Despite the incessant warnings from security researchers, millions of people are still turning to weak, easily guessable passwords to protect their devices.

According to their research, which is based on five million hacked accounts, 10 per cent of people have used at least one of the 25 worst passwords in the past year.

THIS YEAR’S WORST PASSWORDS

Each year, Los Gatos-based firm SplashData evaluates millions of leaked passwords to determine which are the most easily hacked.

Here is the complete 2018 list:

1  123456

2 password

3 123456789

4 12345678

5 12345

6 111111

7 1234567

8 sunshine

9 qwerty

10 iloveyou

11 princess

12 admin

13 welcome

14 666666

15 abc123

16 football

17 123123

18 monkey

19 654321

20 !@#$%^&*

21 charlie

22 aa123456

23 donald

24 password1

25 qwerty123

Each year, Los Gatos-based firm SplashData, which provides identity protection services, evaluates millions of leaked passwords to determine which are the most easily hacked.

The list features several ineffective passwords that have, for some reason, long maintained their hold among internet users.

After ‘12345’ and ‘password’, the next five top passwords on the list are simply numerical strings – 123456789, 12345678, 12345, 111111 and 1234567.

There are several themes across the worst passwords list, including first names and hobbies such as ‘donald’ and ‘football’.

‘Hackers have great success using celebrity names, terms from pop culture and sports, and simple keyboard patterns to break into accounts online because they know so many people are using those easy-to- remember combinations’, said Morgan Slain, CEO of SplashData.

‘Our hope by publishing this list each year is to convince people to take steps to protect themselves online,’ he said.

According to SplashData, of the five million leaked passwords evaluated for the 2018 list, most were held by users in North America and Western Europe.

Passwords leaked from hacks of adult websites were not included in the report.

To create a strong password, the firm recommends people use a passphrases of twelve characters or more with mixed types of characters.

They also recommend using different password for each logins.

That way, if a hacker gets access to one passwords, they will not be able to use it to access other sites.

Users can also use a password manager to organise passwords, generate secure random passwords, and automatically log into websites.

Experts warn that adding a number or symbol to a common word is also an ineffective trick.

The reason changing a password frequently does not help is because when most people change their password they make minor tweaks such as replacing the number 1 with a number 2.

These small changes are called ‘transformations’ and hackers are very aware of them and build them into their scripts.

Previous research has shown men are 2.8 times more likely to use this obvious phrase than women.

‘Instead, they’ll use a method called a dictionary attack, where the program will cycle through a predefined list of common words that are used in passwords.’

Here are some steps to follow when creating a new password:

DO:

• Use a combination of numbers, symbols, uppercase and lowercase letters
• Ensure that the password is at least eight characters long
• Use abbreviated phrases for passwords
• Change your passwords regularly
• Log out of websites and devices after you have finished using them

DO NOT:

• Choose a commonly used password like ‘123456’, ‘password’, ‘qwerty’ or ‘111111’
• Use a solitary word. Hackers can use dictionary-based systems to crack passwords
• Use a derivative of your name, family member’s name, pet’s name, phone number, address or birthday
• Write your password down, share it or let anyone else use your login details
• Answer ‘yes’ when asked to save your password to a computer browser