The unwashed masses are horrible at picking passwords. We're reminded of this sad truism every time there's a major leak—like the 2012 dump of passwords belonging to LinkedIn users, for example. Now researchers who have cracked more than 11 million Ashley Madison passwords have released the top 100 choices users of that site picked. It won't come as a shock to hear that the passcodes are no better.
The top 10 Ashley Madison passwords are 123456, 12345, password, DEFAULT, 123456789, qwerty, 12345678, abc123, pussy, and 1234567. With the exception of choice number 9, the passwords look like they could have come from just about any site breach published over the past decade. What's disappointing here is that after more than 10 years of awareness, users continue to make such awful picks—and websites like Ashley Madison continue to allow them.
By virtue of being cracked, all of the 11.7 million passwords recovered so far were weak. Had they been long, randomly generated strings continuing upper- and lower-case letters, numbers and symbols, they'd be among the 3.7 million cryptographic hashes that still haven't been deciphered. As bad as it is that 11.7 million accounts were protected by weak passwords, there's yet another number the underscores just how careless the Ashley Madison masses were: Only 4.6 million of the 11.7 million recovered passwords were unique.