So this has been a week for tech news, hasn't it. Twitter finally went public on Thursday, priced at $26, popped over 70% on day one, and every single blog with a pulse spent three days writing about Jack Dorsey ringing the bell. I'm not going to do that here. Partly because I have nothing to add that fifty other people haven't already said better, and partly because a much smaller story caught my attention this week and I can't stop thinking about it.
Remember the Adobe breach from last month? The one where they first said 2.9 million customers got hit and then, a few weeks later, quietly revised that number up to 38 million? Well, the actual password file from that breach has been floating around, and over the past several days security researchers have been picking it apart. What they found is somehow both hilarious and depressing at the same time.
Adobe encrypted the passwords instead of hashing them, and did it badly enough (same key for everyone, ECB mode, so identical passwords produce identical ciphertext) that you don't even need to crack the encryption to see patterns. You can literally just count how many accounts share the same scrambled blob and know they all picked the same password. Combine that with the plaintext password hints Adobe also stored right next to the encrypted passwords, and cracking most of these took basically no effort at all.
The results, if you haven't seen the list going around: the single most popular password, used by something like 1.9 million accounts, was 123456. Not even 1234567. Just the plain six-digit staircase. Second place was 123456789, because apparently some people wanted to try harder. Third was just the word "password." Further down you get "adobe123," which is almost charming in a "at least you tried to be relevant" kind of way, and "qwerty," and "111111," and, my personal favorite, "photoshop." Somebody out there protected their Adobe account with the word Adobe makes.
I want to be annoyed at these people and I can't quite manage it. I've had a "throwaway" password I used for a dozen sites back around 2009 and I genuinely could not tell you today whether it would show up on a list like this. Probably would have. The uncomfortable thing about a leak like this isn't that dumb people exist, it's that it's a random sample of everyone, and everyone includes a lot of otherwise smart, careful people who just have a hundred accounts and one brain.
I switched to a password manager a while back (LastPass, for what it's worth, though I know people who swear by KeePass instead) and I still catch myself, every couple months, typing some site's password into the wrong field out of habit because muscle memory is stronger than good intentions. Old habits don't die, they just get outsourced to software that can be bad at its job too, and then you're trusting a different single point of failure instead of no point of failure at all. Not exactly a comforting thought at midnight.
The other thing worth mentioning, since it's connected: Adobe also had actual source code stolen in this breach. Photoshop, Acrobat, ColdFusion. Not just customer data, the source. Nobody's really talked about what that means yet, and I suspect we'll be finding out for a while, in the form of vulnerabilities that get discovered a little too efficiently by people who happen to already have the code in front of them.
Anyway. If you've got an Adobe ID from ordering something off their site five years ago and forgot about it, this is your sign to go change that password, and while you're at it, maybe don't reuse it anywhere else either. I know, I know, everybody says that. Doesn't mean it stops being true.
One last thing, unrelated: I finally got my hands on a Nexus 5 last week and the screen is genuinely gorgeous, way better than I expected coming from an older phone. That's a post for another day though.