Part 3 of 4
What did 32 million leaked RockYou passwords reveal?
A lot of love: “iloveyou” was the fifth most common password.
In 2009 RockYou, a company that made apps for Myspace and Facebook, was breached, and it had stored every password in plain text. Analysts found 290,731 people using 123456. The fifth most common password was iloveyou. Only 0.2% of passwords met a textbook definition of strong.
Computer scientists at the University of Ontario Institute of Technology later mined the list for meaning. After names and places, the most common verbs were “to be” and “to love,” and “love” turned up about fifteen times as often as “hate.” Affection hid in disguise too: their software counted a surprising number of passwords about tellurium, a chemical element, until the researchers saw where the “te” came from: te amo, Spanish for “I love you.” And they read 14344 as a date, March 14, 1944, until they learned it is code for “I love you very much.” (Count the letters in each word.)
- Source: Imperva Application Defense Center, "Consumer Password Worst Practices" (2010)
- Source: Imperva, analysis of 32 million breached RockYou passwords (2010)
- Source: TechCrunch, "Depressing Analysis Of RockYou Hacked Passwords" (2010)
- Source: Rafael Veras, Christopher Collins & Julie Thorpe, "On the Semantic Patterns of Passwords and their Security Impact", NDSS (2014)
- Source: Ian Urbina, "The Secret Life of Passwords", New York Times Magazine (2014)