Feeds

Adobe users' purloined passwords were PATHETIC

'123456' used as password by nearly TWO MILLION punters

Intelligent flash storage arrays

Adobe's security breach just got worse for the company and the world, after a security researcher revealed that 1.9 million of the company's customers us the string “123456” as their password.

The researcher in question is Jeremi Gosney of the Stricture Group, whose Twitter profile claims The Reg has in the past labelled him a “password security expert”. Gosney says he came across the purloined passwords on one of several online dumps and analysed them to see which passwords are most-used by Adobe customers.

The list makes for ugly reading. Here's the top 20.

Password Number of users
1. 123456 1911938
2. 123456789 446162
3. password 345834
4. adobe123 211659
5. 12345678 201580
6. qwerty 130832
7. 1234567 124253
8. 111111 113884
9. photoshop 83411
10. 123123 82694
11. 1234567890 76910
12. 000000 76186
13. abc123 70791
14. 1234 61453
15. adobe1 56744
16. macromedia 54651
17. azerty 48850
18. iloveyou 47142
19. aaaaaa 44281
20. 654321 43670

Gosney's posted the top 100 here.

Adobe first said three million passwords were pinched in the raid, then upped that number to 38 million and raised the prospect of 150 million people being at risk.

Whatever the number, the results make Vulture South wonder if criminals should have bothered breaking in to steal them: with 1.9 million users relying on “123456” there's a better than one in one hundred chance of unlocking an Adobe account with blind luck.

That this should be the case says a lot about Adobe's password regulations, and maybe Adobe users too. To be fair to the company it's conceivable that many of its users signed up in days of yore, before complex passwords were either necessary or fashionable.

A counter-argument is that the company should have encouraged users to adopt more secure passwords a long time ago. It's doing so now: accounts have been frozen until users reset their passwords. ®

Intelligent flash storage arrays

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.