Article from Zdnet:

The time an end-user spends devising a password this year will be longer than the life expectancy of that password, according to Deloitte Canada.

The research organization said Monday that 90% of user-generated passwords would be relevant for mere seconds under pressure from hackers. Those passwords include so-called strong passwords, which are typically eight characters or more.

Deloitte attributed the vulnerabilities to many of the same issues that have plagued passwords over the years – including re-use of passwords on multiple accounts and obvious passwords patterns. For years, “password” and “123456” have been two of the top passwords favored by end-users.

In addition, hacking tools are getting more powerful using both hardware and software techniques to crack credentials. Also, “crowd-hacking” techniques that marry thousands of machines and being used to brute-force passwords.

Deloitte touched on some of the same issues that Forrester analyst Eve Maler called out last week in her report on passwords, the fact that end-users, unfairly, bear the burden of onerous password creation rules.

Maler argued that passwords are not going away and that companies need to come up with better strategies for managing passwords and password policies.

Deloitte offered its own solutions, including multi-factor authentication that incorporates tokens, biometrics, and out-of-band authentication such as messages sent to a mobile phone. Deloitte also recommended best practices such as security policies and monitoring as ways to protect passwords.

The Deloitte predictions follow a trend that has hackers aiming for authentication credentials. Last year, from hacks on companies from Apple to Zappos, hackers stole millions of end-user credentials, using them to hack not only accounts on the compromised site but reusing those passwords on other sites.

Last year, Best Buy reported that hackers had comprised user accounts on its network using credentials that had been stolen more than a year ago from various other sites.

Most Commonly Used Passwords in 2012:

1. password (Unchanged)
2. 123456 (Unchanged)
3. 12345678 (Unchanged)
4. abc123 (Up 1)
5. qwerty (Down 1)
6. monkey (Unchanged)
7. letmein (Up 1)
8. dragon (Up 2)
9. 111111 (Up 3)
10. baseball (Up 1)
11. iloveyou (Up 2)
12. trustno1 (Down 3)
13. 1234567 (Down 6)
14. sunshine (Up 1)
15. master (Down 1)
16. 123123 (Up 4)
17. welcome (New)
18. shadow (Up 1)
19. ashley (Down 3)
20. football (Up 5)
21. jesus (New)
22. michael (Up 2)
23. ninja (New)
24. mustang (New)
25. password1 (New)