1.4 Billion Passwords Leaked From Popular Sites, Proving How Hopeless We Are At Online Safety

When it comes to hackers, superior coding skills and a keen eye for weaknesses is obviously an important trait.

However, almost every time, the easiest way to gain access to something is pick out the weakest link. In hacking, that¡¯s the human element. Our our inability to choose complex passwords!

You see, as secure as companies make their software and online services, that safety depends on how consumers implement it. No amount of security is going to keep your email safe if you write the password down on a sticky note on your desk.

That¡¯s proven true once again in the latest data dump of leaked passwords circulating online. Cyber security research firm 4iQ says it¡¯s discovered a database on the dark web containing a whopping 1.4 billion user credentials. The worst part is that all the passwords in the dump are available in plain text, without any encryption.

It¡¯s a massive 41GB collection of usernames and passwords leaked in at least 252 other previous hacks, gathered together into one database, 4iQ CTO Julio Casal said in a blog post. Though the collection had already been circulating on the dark web for weeks at least, it gained more attention last week when a user posted a link to it on Reddit. It contains credentials for a variety of services like Bitcoin, Pastebin, LinkedIn, MySpace, Netflix, YouPorn, Minecraft and Runescape.

¡°None of the passwords are encrypted, and what's scary is that we¡¯ve tested a subset of these passwords and most of the have been verified to be true,¡± Casal said. ¡°The breach is almost two times larger than the previous largest credential exposure, the Exploit.in combo list that exposed 797 million records.¡±

Courtesy: 4iQ

More worrying however, are the kinds of passwords leaked in this list. Not only, 4iQ found, are people reusing passwords across websites, but also continue to use old passwords despite those services having reported being hacked in the past. The most common strict no-no passwords found in the database are were ¡°123456¡±, ¡°123456789¡±, ¡°qwerty¡±, ¡°password¡± and ¡°111111¡±. A few other gems included ¡°abc123¡±, ¡°666666¡±, and ¡°1q2w3e4r5t¡±.

It¡¯s not yet clear just who uploaded (and updated as late as November) the archive. So if you want to keep yourself safe, there are a few very common best practices. Don¡¯t reuse old passwords, don¡¯t use them for multiple accounts, and for the love of God don¡¯t just hit sequential keys on the keyboard and think that¡¯s a smart tactic.