Choosing Passwords Wisely

I got a message from someone today who forgot their password. I won't name names, but in the message the person included the password they wanted, and that it "somehow" got changed because they "knew" that's what it used to be.

These kind of messages are usually rare for me--most people just tell me that they forgot their password, and I either send them to the Lost Password Center to reset it, or manually reset it myself if they're e-mail address doesn't seem to work. They usually don't send me the password they want it set to--I'd just as soon not know, and there's no reason I need to know. I can log into any account I need to with a "master password" when I need to--I never need to know anyone's actual password. Passwords are stored in the database in an encrypted format that's specifically designed so that I can't even decrypt it even if I wanted to. If hackers ever broke into Atlas Quest, they might be able to steal your e-mail address or cause all sorts of mischief, but there's one thing they can't get--it's your password.

Unless it's a poorly selected one. And alas, there are a lot of poorly selected passwords. Many moons ago, I read an article in a magazine about the ten most common passwords, and out of curiosity, I ran them through AQ's accounts to see if people actually were using them. Some of the most common passwords of all time, in case you're curious, include: password, 123456, qwerty, abc123, letmein, monkey, and money. Every single one of the most common passwords were being used by people--some of them in numbers that made my mouth drop open in shock. Passwords such as god did not get any hits since AQ has always required passwords to have at least five characters, even from day one.

I tried a few other "obvious" guesses including atlasquest and letterboxing, cracking loads of additional accounts. Then set it up so AQ tried using the same password as the trail name for the account, which as I recall, was the mother load.

Almost immediately, I added new restrictions on passwords to encourage people to pick better passwords. I made those most-common passwords off limits, and AQ will reject them. It will also reject any password if you use your first name, last name, or trailname as your password (or even a part of it). Which brings me back to the person who said that somehow their password had been "changed." Since the person told me the password they wanted, I could see the problem. It included their first name. The password wasn't changed--AQ had just rejected it as being too easily guessed and the person didn't remember their second choice.

A letterboxing website probably isn't a hacker's paradise, and even if a hacker did get into your account, they probably can't do more than delete your boxes or finds and send offensive messages in your name. But why choose bad passwords in the first place? Do you use the same passwords for your bank accounts, brokerage accounts, and other places where sensitive materials reside? Hackers DO try to break into those kinds of accounts, and easy-to-guess passwords make YOU a tempting target.

Some of you might remember the password cracker I set up the last time I discussed password security, and we had a lot of fun "cracking" accounts on Atlas Quest. All told, with all of the various guesses and such, we successfully cracked close to half the accounts on Atlas Quest. Without knowing any personal data about you, we could hack into about every other account given enough time to make guesses.

It might be a little harder now since AQ no longer allows the most common of passwords anymore (however, old accounts that made it in before the change still got to keep their poorly selected passwords, so those do still exist), but I bet there's still a lot of passwords you can guess. AQ will no longer allow you to use your first name, last name, and trail name (at least not what you entered when you registered on Atlas Quest), so those types of guesses won't be anywhere near as successful. But AQ doesn't know your birthday, it doesn't know the names of your children or pets, and it doesn't know much about you on a personal level, so it can't stop you from selecting those types of bad passwords.

If you're using a bad password now, consider changing it. Make your online accounts safe again!

Still don't believe? Try cracking accounts yourself and see how many you can break into with the Password Cracker.

I just want to say to the five people who use the word "goober" as a password--I'm honored. But you really need better passwords than that. ;o)

I'm also happy to report that while there are no "losers" on Atlas Quest, we do have four "winners"! Let's give our winners a round of applause. =)