Fixing trivial passwords is as straightforward as 123456

How come it’s nonetheless doable to ‘safe’ a web based account with a six-digit string?

07 Could 2026
 • 
,
4 min. learn

Essentially the most-used password globally is strictly what you assume it’s: ‘123456.’ That’s in accordance with NordPass’s newest annual report on passwords uncovered in knowledge breaches globally. Different all-too-predictable selections, comparable to ‘123456789’, ‘12345678’, ‘12345’ and ‘admin’, additionally show to have endurance 12 months after 12 months.

My first intuition is to dismiss this as scaremongering fodder, particularly on condition that poor password hygiene was additionally a part of a group engagement session I offered on the latest RSAC convention, Let’s Rant: 4 Issues That Must Change in Cybersecurity.

However since at the moment is World Password Day, I needed to put this to the check: Can I nonetheless discover a moderately mainstream web site that enables me to create an account utilizing ‘123456’ because the password? Sadly, the reply is sure.

There are common websites, comparable to ‘evite’, that also permit this actual six-digit string for use as a password. You might dismiss it as simply an e-invite service, till you understand that you simply’re sharing private knowledge in your invites and probably handle the responses of all of your invitees by an account that isn’t safe. The surprising a part of this very crude check is the discovering that Evite was topic to a knowledge breach in 2019 that affected the private data of over 100 million folks. The corporate ought to most likely know higher than to permit its customers to have such weak passwords.

The state of affairs isn’t drastically higher on much more common companies. After I tried to create a brand new account on Fb, the platform did mandate a further degree of password complexity. However nonetheless, a string so simple as ‘1234567!’ turned out to be a permitted password. X supplied an analogous expertise.

Now, Fb, for instance, does provide some recommendation, comparable to: “keep away from utilizing widespread phrases comparable to ‘password’’ and “In case your password isn’t robust sufficient, combine uppercase and lowercase letters. Make it extra complicated through the use of an extended phrase or collection of phrases which you could bear in mind however others received’t know.” But, it permits ‘1234567!’ for use, no letters, only a sequential sample with a easy exclamation mark on the finish, all simply guessable, particularly by automated scripts that check accounts en masse for generally used patterns and strings.

In the meantime, Collins Dictionary, which is residence to far much less delicate content material, compelled me to create an eight-character password containing at the least three of the next – decrease case (a-z), higher case (A-Z), numbers (i.e. 0-9) and particular characters (e.g. !@#$%^&*).

NordPass’s knowledge means that there are lots of extra websites that set restricted password insurance policies and permit trivial passwords like ‘123456’. Nonetheless, I believe there may be components of legacy within the technique used to calculate the commonest passwords. For instance, if an organization has existed for 10 years and by no means deleted any dormant person accounts, then a breach would come with outdated dormant account data, a few of which can be from earlier than any password coverage was enforced. The motivation behind publishing headline-snatching knowledge can be clear: the distributors that create the information story are set to probably profit as they supply password administration software program for a subscription.

Breaking the cycle

Now, how will we resolve this unending loop of negativity about passwords, together with the ridiculous state of affairs that platforms nonetheless allow non-secure passwords?

I don’t help the thought of legislators needing to mollycoddle residents, however on this occasion I believe it’s time for lawmakers to step up to speed and put a cease to the sample of firms not implementing stringent authentication insurance policies and permitting shoppers to take the straightforward choice. There may be widespread privateness laws stating that firms have to safe our private knowledge in the event that they retailer it, utilizing acceptable cheap cybersecurity measures. A core a part of these measures is using robust, complicated passwords and multi-factor authentication (MFA), as required by any self-respecting cybersecurity framework. But, in lots of situations there aren’t any cybersecurity necessities on authentication for customer-facing companies.

Then again, some industries have been compelled to replace to fashionable authentication strategies. Within the finance business, for instance, there are a number of rules, such because the Fee Companies Directive 2 (PSD2), that mandate MFA for digital funds and entry to fee accounts on-line.

Laws ought to lengthen to all industries: merely implement MFA for all accounts created on-line whatever the service being accessed, ditch the outdated use of passwords, and transfer to extra acceptable safety for at the moment’s web.

The potential hurdle to mandating this method is the barrier to entry for folks creating accounts. Corporations reliant on promoting or the gathering (and sale) of non-public knowledge for income will foyer considerably in opposition to the transfer, and corporations with large budgets will probably be very demanding that nothing steps in the way in which of revenue, particularly one thing like securing buyer accounts by requiring a posh password and/or MFA.

For many of my 30-plus-year profession within the cybersecurity business, the difficulty of weak passwords has been a staple message pushed out each day, at many occasions, and on a specifically nominated day. There’s a easy and efficient option to resolve it: mandate complicated passwords or, higher but, MFA. Can we please cease the dialog about ‘weak passwords’, as soon as and for all?