Believe it or not, ‘Hackers’ is my inspiration for today’s post (after watching it for possibly the millionth time on Saturday night). Just after Fisher Stevens had chastised Lorraine Bracco’s character for using one of the four most commonly used passwords, I started thinking about the likelihood of that information actually being true.

Unsurprisingly, the passwords quoted - god, love, secret and sex - were inaccurate. And yes, the film was released in 1995 so it’s dated, but back then the same would have been true.  I’m not just being cynical either, technical consultant Eric Coley agrees – and he was the one that advised the filmmakers on hacker ‘subculture’ in the first place.

But back to the point, I’m always curious about the reliability of these ‘most used’ lists. The most common method of creation is to use an aggregate sample of passwords – but how has the data been sourced? Has someone simply polled a group of people, and asked them to hand over information about old logins? Well, that in itself would mean the results would be obsolete, as they would no longer be in use.

If the sample had been asked for current passwords, how many people do you think are likely to give out current, active data? I guess the most sensible way would be for one of the big email players to set up an opt-in list, and review lists of passwords separately – with no associated address or user data attached. After all, we all know that a password out of context is useless, so there wouldn’t be any privacy issues.

This all probably stems from a survey I once took part in, focussed on just this topic. I was asked to review a list of about 100 key words/phrases, and highlight whether I’d ever used one of them. Astonishingly, none of my past or present passwords appeared on the list. But imagine that they had hit the jackpot and a small group of people had made same choice. That would mean that that particular word or phrase automatically becomes the ‘most used’, regardless of whether it’s truly representative. There could have been a larger percentage of people using a password that wasn’t on the list.

All this goes toward my thinking that you just can’t create a definitive list of ‘most used’ passwords. It’s an impossible task, much like saying; ‘we’re going to collate a league of the most used phrases in the English language’. You could talk to 1,000 people and come up with a top ten, but it’s simply not exhaustive enough.  The same goes for passwords.

And on the ‘most commonly used’ note, I basically use the same password for all of my accounts. It’s just easier. But is that a bad thing? I think it’s pretty common practice, but does this have an effect on my likelihood to be targeted by fraudsters? I decided to talk to a man who knows a lot more about security than I do, and called Dave Stanley from Proofpoint. Even though his game is email security, he’s been working in this space for a long time.

Lo and behold, after a quick chat, we were in agreement that nowadays a large number of people are almost forced into using a single, easy to remember password. So I’m not alone. There will always be savvy people who have more complex passwords to protect high value data. But when you need a password for every service imaginable, there are many more people who just can’t remember multiple login details and opt for a solitary version.

Everyone is aware that security is an issue, but don’t always take it seriously. Dave pointed out that at any time you could probably walk into your friend’s house, turn their computer on and talk to their contacts as them on IM, auto-login to email or cause general havoc. Now, I’m fairly sure none of my friends would want to do that to me, but it’s certainly a good example of how blasé we can all be.

I think the bottom line is that having a single password for multiple accounts doesn’t make you more of a target – but puts you at a greater risk should it be discovered.  It’s part of the reason I don’t trust single login systems. They are certainly easier, but if your password is compromised - its taint amount to loosing your wallet. Everything is gone in one swift hit.

A final little tip courtesy of Dave; he suggests that a really easy way to protect yourself is to choose an alphabetical password, and substitute vowels for numbers. This way, you can create multiple variations for different sites, but all based on a single theme. And happily, that gets around the annoying ‘you must include at least one number’ catch that’s included in so many sign ups today.