Hacker News Reader

... of the people foolish enough to give their passwords away.

It included Stephen Fry (Or at least his co): http://twitter.com/stephenfry/status/4659713168

Any details of how the scam worked and why so many were caught? I haven't seen any real details on it.

"123456" - 64 times out of 10,000, i.e. 0.64 percent.

So if you know 200 account names you should make it at least once, right?

A bit more than 200, probably over 600 accounts with the same password distribution and you're looking at close to a certain chance of hitting at least one account with that password.

One thing that keeps bothering me about this story and many others based on the same data is that those 64 passwords are such a minute portion of the total set of accounts. Perhaps if they had done some further analysis like comparing password sequences composed on contiguous letters in various keyboard layouts then passwords like "qwerty" or "asdfgh" could similarly be grouped together.

Since many people use the same password everywhere, would it be safe to say that `123456` is universally the top pick?

That was also the most common password in a user database that I did anonymized analysis of in my distant past. Depending on your definition of safe, I'd say yes.

Most Common Hotmail Password