Koch Foundation

NOVA Science Trust Logo

The 19 worst passwords, as identified by SplashData.

Top 19 Worst Passwords

<div class="related"></div>
<p>If your go-to password is "password" or "123456," you should probably stop reading and go change it—both topped SplashData's list of the most common passwords of 2011. The software company was able to create this list by analyzing millions of passwords that hackers had stolen and posted online. According to SplashData CEO Morgan Slain, "password" and "123456" were among the ten most common passwords in over 90% of the individual files hackers posted.</p>
<p>Microsoft researcher Cormac Herley, who specializes in computer security, said based on the lists of stolen passwords he has seen, he suspects that between 0.2 and 0.5 percent of all passwords are the word "password." If that's true, a hacker trying to break into 1,000 different accounts using "password" will likely gain access to between two and five of them.</p><p>If you didn't find your password in the above image, don't applaud yourself quite yet. Having a strong, hard-to-guess password can only do so much. "It's definitely better, but it's better against one particular type of attack," Herley said, referring to the "guessing attack" described above in which a hacker tries different username and password combinations to gain access to an account.</p><p>"If you inadvertently install something that's a password stealer, it doesn't matter how strong your password is."</p><p>Unfortunately, hackers usually take more efficient routes. Sometimes they exploit weaknesses in applications within internet browsers to secretly install keystroke-logging software onto users' computers; other times they create seemingly-innocent websites that lure users to directly reveal their login information. "If you [inadvertently] install something that's a password stealer, it doesn't matter how strong your password is," Herley said.</p><p>To protect yourself from these types of attacks, Herley recommends that you run up-to-date software. Hackers often exploit known vulnerabilities in applications like Flash or Java, and the longer a version of a program has been available, the more likely it is that hackers have learned how to break into them. He also recommends installing antivirus software.</p>
<div class="ad"></div>
<p>Hackers also target servers directly. In 2009, someone broke into the server of the social-gaming site RockYou and released over 32 million passwords, including user login information for partner sites like MySpace. Websites are supposed to encrypt passwords, meaning that rather than storing a user's actual password, they store a "hash"—the result of a specific function calculated on it. But RockYou had stored the passwords in plain text, meaning when hackers gained access to the database they found an easily exploitable list of usernames and corresponding passwords. Herley called this "really, really bad practice."</p><p>Although there is no foolproof way to protect yourself from an attack on a server, Herley said you should take measures to ensure that a breach on a low value site does not compromise their security on a more important one. Although creating new passwords for each site you use is sound advice, in practice, people may not be able to choose unique passwords for every single account they have. Herley recommends that users rank them in order of importance—creating a unique password for your email account is likely more important than making five different passwords for five different online magazine subscriptions.</p><p>No new technology, especially on that requires a physical device, will ever be cheaper than passwords, which essentially cost websites and users nothing.</p><p>Given the various ways in which hackers can exploit traditional password login systems, one may wonder why we still use them. Researchers <i>have</i> proposed and developed new ways of verifying an individual's online identity. Sites could require users to scan their fingerprints or insert personalized smart cards into specialized readers attached to their computers. But Herley said he doesn't see the new technologies replacing traditional login systems any time soon for one main reason: cost. No new technology, especially one that requires a physical device, will ever be cheaper than passwords, which essentially cost websites and users nothing.</p><p>He used Facebook's "explosive growth" as an example. The site grew to nearly one million users before it received any big investments, a feat that would have been impossible had authenticating the identity of each user cost even as little as ten cents.</p><p>Sites' continued reliance on traditional verification methods does not mean that internet security has stopped improving. Companies are constantly working behind the scenes to augment password systems, implementing new techniques of verifying user identity such as tracking the locations of the computers in which a user logs in. If a website detects something unusual—like a login on a new computer in a different country—it can boost its security by requiring the user to enter additional information, like a code that is text messaged to the number linked to the user's account.</p><p>As the methods sites use to protect users' information advance, so too will hackers' determination to crack them. But before you spiral into panic, rest assured that although a spammer might find his way into your Facebook or email accounts, most Internet users will never suffer from a devastating theft of cyber identity. Still, "Anyone who has been online for any amount of time should have their guard up," Herley said. He means you, "password" users.</p>
<div class="newsletter"></div>

<p data-block-key="fg78g">Discover the 19 worst passwords and learn how to keep your password safe from computer hackers.</p>

LABRADOR was developed by scientists at the Oak Ridge National Laboratory to sniff for 30 classes of chemicals given off by decaying bodies.

Courtesy of Oak Ridge National Laboratory

Three Advances in Forensics

<div class="related"></div>
<p>Imagine placing the entire population of Wyoming's capital city behind bars for crimes they did not commit. Studies estimate that roughly that number of people, or between one and five percent of the two million people in U.S. prisons, have been mistakenly convicted. One reason for these wrongful convictions is the fallibility of many of the methods currently used in forensic science. The twin threats of criminal misidentification and new technology that may allow criminals to act more anonymously than ever before are spurring researchers around the world to find new ways to better understand mysterious crimes and correctly identify their perpetrators.</p><p>"I would say, in my humble opinion, that any case could be solved given enough time, money and resources," says Arpad Vass, a chemical forensics researcher at Oak Ridge National Laboratory in Tennessee, referring to the promise of new forensic techniques.</p><h3>Sniffing Out Victims</h3><p>Often, the first step in identifying who committed a crime is identifying the victim. That's why Vass developed the Light-weight Analyzer for Buried Remains and Decomposition Odor Recognition system for locating dead bodies, known as LABRADOR for short.</p><p>"Finding clandestine graves has been a nemesis for over a decade now," he says.</p><p></p><p>The apparatus that is now being developed by the Agile Technologies company looks like a metal detector, but contains a small box on the end that collects air samples, Vass says. The box contains 12 sensors that respond to 30 classes of chemicals that decaying bodies emit. It also has both a visual display and an audio signal that relay information about chemical concentrations to the user. Criminal investigators can then scan areas and dig for bodies where those readings are highest.</p><p>Cadaver dogs are commonly used to find bodies, but dogs are unable to smell relative concentrations of chemicals as accurately as the LABRADOR. Ground water can move chemicals away from a decaying body by up to a kilometer, Vass says, so dogs often locate a person's scent far from the actual site of a body. But when the LABRADOR is used in conjunction with dogs, scientists can home in on the precise area where the chemicals are the most concentrated.</p><p>Additionally, the composition of the chemicals emitted give information about how long ago the person was killed, because as the body decomposes, the odor signature it emits changes.</p><p>In some cases, locating bodies provides crucial evidence to help link suspects to the crime. But other times the goal is simply to provide families with a sense of closure.</p><p>Vass says the LABRADOR was used in 2010 to find the body of Lynsie Ekelund, who had been reported missing in 2001. Detectives knew she had been buried somewhere on a 40-acre ranch, and the LABRADOR device enabled them to start digging within 15 meters of where her body was ultimately found.</p><h3>Detecting Chemical Impurities</h3><p>Across the country at the Pacific Northwest National Laboratory in Richland, Washington, chemist Carlos Fraga is working on a new forensic technique that also involves analyzing chemicals. But unlike Vass, he is trying to locate criminals, not victims.</p><p>Fraga's work focuses on a highly threatening form of terrorism: chemical attacks. He works for the Department of Homeland Security, which began a chemical forensics program in the aftermath of the 2001 anthrax attacks in the U.S.</p><p>Unlike bomb explosions or gunshots, which leave unique physical traces, detecting the origin of a chemical attack poses more of a problem for forensic scientists. A terrorist could easily release a potent gas in a large crowd and sneak away as its effects take hold, leaving behind nothing but a wave of sudden, and sometimes fatal, illness.</p><p>Fraga's team has figured out a way to trace the origin of a deadly chemical by analyzing its impurities. His lab has been working with sarin, a chemical agent that attacks the nervous system.</p><p>Each batch of sarin has a distinct amount of impurity that makes it unique from other batches. What separates Fraga's work from that of other scientists is that he is the first to show that the impurity pattern can reveal the type of chemicals from which the sarin was produced. That same impurity profile exists within the original chemicals as well, he says.</p><p>Careful analysis is required to determine the probability that a piece of evidence and a suspect are linked.</p><p>With Fraga's technique, chemicals at crime scenes could be matched to chemicals more closely linked to suspects. Police could also use it to map patterns of drug flow into their countries.</p><p>Fraga says the main problem right now is that no one is sure how reliable chemical tracing is. He says that TV shows like CSI often depict scenarios in which someone receives a piece of evidence and instantly exclaims, "It's a match!" But in reality, careful analysis is required to determine the probability that a piece of evidence and a suspect are linked. His team is working to discover what some of those probabilities are.</p>
<div class="ad"></div>
<h3>Steps to Prevent Crime</h3><p>While Fraga's research centers around developing a method to find potential criminals, Marios Savvides is focusing on security systems that will help to prevent crime in the first place. For Savvides, each literal step forward is a metaphorical one as well; in his bio-pedometrics lab at Carnegie Mellon University, he is studying the unique imprint of a person's foot as he or she walks.</p><p>His work is part of a collaboration with Autonomous ID, the company that is funding the research at CMU and whose chairman and president Todd Gray developed the idea for the bio_sole, a device that measures the way in which a person's foot hits the ground to verify his identity. Such a device could replace measures that high-security areas now have in place to protect their privacy, such as fingerprint and retina scanning.</p><p>Gray says he was inspired to "resolve enemy impersonation" after an incident in January 2007 in which disguised insurgents infiltrated a U.S. army base and killed several soldiers.</p><p>The bio_sole will look like a Dr. Scholl's shoe insert but will measure the dynamics of a person's foot as they move—a characteristic unique to each individual. Savvides is currently developing algorithms to verify individuals' identities. His team is studying the differences in individuals' gaits and footprints, examining questions like how the device will be able to recognize a person's foot movements as they change with age, injury, or different forms of movement like running.</p><p>Fingerprint and retina scanning involve only a physiological means of verifying identity, which means that war enemies could cut off the required body part and use it to gain access to high-security areas. "There's different rules of engagement there," Gray says.</p><p>But the bio_sole uses both physiological traits—such as the way in which a person's foot is shaped—<i>and</i> behavioral traits—such as the way in which a person walks—to verify identity. Even if a potential insurgent cut off another person's foot, he would be unable to precisely mimic the way in which he walks.</p><p></p>
<figure class="richtext-image full-width">
<img alt="" class="richtext-image full-width" src="https://staging.pbs.org/wgbh/nova/media/images/three-advances-forensic-01.width-990_Jhu4Pdl.jpg"/>
<figcaption>The way each person sets their foot down to create a footprint is unique, which scientists are exploiting to create new a new method of for identifying people.
        
        <div class="credit">Courtesy of LifeInMegapixels</div>
</figcaption>
</figure>
<p></p><p>Savvides says the bio_sole has other advantages as well. Facilities that rely on fingerprint or retina scans require people to pause and wait for a machine to authenticate them. If a person is wearing a hazmat suit or sterile gloves, the process can take even longer. In places like hospitals, where every second counts, such a delay could be life-threatening. The bio_sole, however, verifies someone's identity as they move naturally.</p><p>Additionally, with the bio_sole, all the information about an individual is contained within the shoe itself, eliminating some of the privacy issues and costs associated with other systems. With fingerprinting or retina scanning, databases of information used to verify people's identities must be secured and encrypted. But the bio_sole system is self-contained, meaning the sole itself simply sends a yes or no signal to an access point depending on whether it recognizes the individual wearing it, Gray says.</p><p>Savvides says the bio_sole could have other forensic applications as well. As his team researches individual foot dynamics, they may better be able to identify key traits of the person who left a footprint at a crime scene like his or her age, gender, and form of movement.</p><p>Forensic tools that once seemed to belong in the realm of science-fiction are becoming more real every day.</p><p>Though the bio_sole's applications are "potentially limitless," Savvides says his team still has to do more research to ensure that the sole can correctly identify a person across their entire range of foot movements. Additionally, they need to learn whether people's foot dynamics will change with age or illness to determine how often the device needs to be updated.</p><h3>Will Science Ever Stop Crime?</h3><p>New ways to detect odors, analyze chemical impurities, and identify individuals by their foot movements are just a few examples of the current scientific advances in crime-fighting techniques. Forensic tools that once seemed to belong in the realm of science-fiction are becoming more real every day. Scientists can now study a person's hair to determine what they have eaten and where they have been. They can use lasers to analyze the composition of liquids and gases without affecting the substance itself. In the future, it may even be possible to detect lies with brain scans, though such techniques have been met with intense skepticism thus far.</p><p>Despite the best efforts of scientists to advance forensic techniques—whether it's finding victims, catching criminals, or keeping areas secure—fighting crime is like shooting at a moving target, Gray says. "As the forensic sciences moves forward, so does the means of trying to circumvent those sorts of things."</p><p>Additionally, Vass says most law enforcement agencies are understaffed and lack the money to employ some of the technological advances.</p><p>While using new techniques is important, Fraga says, so too is understanding their limits. "It goes back into understanding the uncertainty and the limits of these techniques." he says. Forensic science "really has to be approached by the scientific method."</p><p>It is unclear whether advances in forensic technology will reduce the alarmingly high number of innocent people in prison. It seems unlikely that scientific developments alone will eliminate every possibility for error in the criminal justice system. But perhaps they will serve to cut the number of mistaken convicts in half—to say, the number of people found in Alaska's capital city, rather than Wyoming's.</p>
<div class="newsletter"></div>

<p data-block-key="dncns">Sniffing, sifting, and sensing new ways to solve—and prevent—crime.</p>

Technology, Biology, and a Memory Revolution

<section class="entry-content instapaper_body clearfix" itemprop="articleBody">
<div class="add-container clearfix" id="add-block-placer">
</div>
<p>
  When I share random pieces of information I’ve picked up from science blogs or magazines, my friends often get that “if-this-story-lasts-more-than-three-minutes-I’m-leaving” look in their eyes. But there’s one anecdote that they respond to with appreciation, and even envy.
 </p>
<p>
  It’s the story of Kim Peek, a savant gifted with the extraordinary ability to scan pages of books two at a time and instantly memorize their entire contents. In many ways, Peek had a difficult life. His unique brain structure stripped him of the ability to interact on the same social plane as most people.
 </p>
<p>
  But it’s no wonder my friends sigh with jealousy. To be able to read and remember hundreds of pages of content so effortlessly sounds like a dream come true for most college students.
 </p>
<div class="wp-caption aligncenter" id="attachment_224" style="max-width: 510px">
<figure class="richtext-image full-width">
<img alt="" class="richtext-image full-width" src="https://staging.pbs.org/wgbh/nova/media/images/college-student-reading.width-990_6rGDGX4.jpg"/>
<figcaption>
</figcaption>
</figure>
</div>
</section>

Kate Nussenbaum

Articles

Top 19 Worst Passwords

Three Advances in Forensics

Technology, Biology, and a Memory Revolution

Support Provided By