You have exactly three passwords, don't you? The first is one you use for all the logins that you don't think house anything worth stealing. You use it when you are signing up for a Web site that you might not visit ever again. It's the default password you deploy when you're required to "create a free account" to read an online newspaper or RSVP to an e-invitation.
The second one is medium security. It's probably fewer than eight characters long. It might be alpha-only or alpha-numeric, but does not contain special characters. You probably use this same password for both email and Facebook. And it's possible you don't have a medium security password at all, so let's skip to the third.
The third password is what you use for your bank accounts—all of them. Or worse, you have one password that you use for everything.
Password Reuse is Rampant
Too many of us reuse passwords, and the recent Sony hacks should serve as a call to action to change not only the passwords themselves, but the methods we use to create and remember them.
Software architect and Microsoft MVP Troy Hunt performed an independent data analysis of the leaked passwords from the Sony hacks and compared it with another data set that was made available after Gawker's commenting database was hacked in December 2010.
One of the most shocking things he found (although it's not shocking if you are a password reuser yourself) is that 88 people had both a Gawker and Sony account with the same email address, and 67 percent of them used the same password. It's a small sample size, but an interesting figure nonetheless. And a Security Week study last year reported that 75 percent of people use the same password for Facebook and an email account.
What's more, when Hunt looked through the Sony files, he found that among users who had two Sony accounts (e.g., Sony Playstation and SonyPictures) with the same email address, 92 percent used the same password for both.
People Think Alike
I'm painfully guilty of password reuse, although I made a New Year's resolution to try and fix it after my Hotmail account (which I consider not highly important) got hacked late last year. Luckily, that email account didn't have many actual contacts or private information, as I use it for newsletters and miscellaneous sign-ups, but it was still an eye-opening moment. The problem was that I used the same three-password system described above, and someone, somewhere, got a hold of one of my other username and password combos, probably with a hotmail.com email address attached to it, too. It wouldn't have been hard to guess (or try) logging into Hotmail with the same credentials.
Imagine my surprise when I read the same three-password method outlined in a comment to Hunt's blog post. Way too many of us are guilty of using the same system. People think alike and come up with similar plans. It's not just me.
What people don't seem to realize is just how many Web sites and services have your password. Case in point: Another bit of shocking news from the Sony hack was that Sony stored passwords in text files! If a major international corporation doesn't take any precautions to encrypt the passwords, what can we reasonably expect other sites and services to be doing?
Reality of Passwords
The reality is most people have created dozens if not hundreds of usernames and passwords throughout their digital lifetimes. Is it reasonable to have to have a unique password for every single thing? And do I really care if someone hacks my long-abandoned Plurk account? There are conditions under which I'll accept that risk for the sake of being able to remember certain passwords quickly.
Security gurus tout the relevance of password managers, which generate unique passwords for you and store them under one password-protected program, but even they can be cumbersome. LastPass 1.72 Premium is PCMag's Editors' Choice for password managers. It keeps your encrypted password collection online and works across Windows, Mac, and Linux machines.
But how many people, really, will use a password manager? I think it's more likely that a better way of protecting personal data will come along well before password managers become widely adopted. There has got to be a simpler way. Until then, we'll have to invent our own systems for developing passwords that are unique but memorable. I've heard the advice to come up with a complicated base password (say, X*8ippo) and append to it some combination of letters as used in each URL of the site where you're logging in. Given this example, we might have passwords like ueX*8ippoJE for JetBlue and ixX*8ippoNE for Netflix, and so on. It's still crack-able, but it's not an open door.
Either give in and get a password manager (did I mention LastPass is free?) or come up with a new password system that meets other suggested requirements and change all your logins every six months at least.
For more, see Your Worst Passwords, Ever, PCMag's Six Great Password Managers, and How to Create Strong Passwords.