One evening, during my holidays in Italy, with a couple of friends we joked about how passwords are used that protect many aspects of our electronic life. Since we were from different villages, we started to joke about possible password variations related to the territory. Meanwhile, between a drink and the other, I wondered if I could analyze the passwords with other parameters, such as gender, age, address.

The Libero.it leak

In 2016, the Italian email hosting service LiberoMail revealed an attack resulting in exfiltration of many database records. Not well implemented security measures exposed user and passwords in clear text along with the address and some other user’s details. The LiberoMail users database was breached.

I decided to take a look at the data, clean them up (in addition to the security problem, they also had a data normalization problem), put everything in a database and run some queries on it.

The Data-set

The data set consists of approx. 700,000 records, not all with complete fields. In many cases, for example, the age has been extrapolated from the user name, from the e-mail address or even from the password itself.

Some simple counts

Gender and Age

The gender (declared by user) and the age distribution are reported in the next charts:

The Analysis

Using our self-developed tools, we cleaned and normalized the raw-data and put the results in a relational DB.

For the analysis, we identified following characteristics:

Password

• Length: How many chars has the password
• Complexity: We add one point for each lowercase-, uppercase-, number-, punctuation-category, if present in the password
• Common names: Based on a list of most used Italian first and last names, we check if the names are part of the password
• Self-contained: We checked if the password contains the username (or part of it) or birthday (or part of it)

User

• Age: Sometime declared by user, sometime extrapolated from the username or password
• Region: The four Italian main regions (Nord, Center, South, Islands)

The Results

Password Length

Following charts shows how the password length varies if compared with gender, age, and region.

Remarks:

• Women uses longer passwords
• Age group 20-29 use longer passwords
• Password length of 7 and 8 chars are the most used
• The region does not influence the password length

Password complexity

Following charts shows how the password complexity varies if compared with gender, age, and region (one point for each lowercase-, uppercase-, number-, punctuation-category).

Remarks:

• Women uses complexes passwords
• Age group 20-29 use complexes passwords
• The region does not influence the password complexity

Password Complexity vs Length

Following chart shows how the password length and complexity are related.

Remarks:

• 25% of 6-chars passwords have complexity 1
• Most of the passwords longer than 10-chars have also complexity 4

Usage of Common Names

Following chart shows how the user makes use of common names (most Italian used first and last names), aggregated by gender and region.

Remarks:

• Woman prefer common names in passwords
• Especially the women in northern Italy

Special Passwords

Following charts shows how the female and male users uses the specific passwords juventus, napoli, amoremio, 123456.

Remarks:

• Users from Islands do not like password 123456
• juventus and napoli are well diveded by North/South

Top Passwords

Following charts shows the top 20 passwords and the top 20 passwords containing a common name.

Remarks:

• popopo90 is the phonetic transcription of the stadium anthem of the Football World Championship Italia 90

Conclusion

Women seem to have safer passwords than men, even if in the north they exaggerate with the use of common names. Nice as usual the diatribes between Juventus and Napoli that remind us how in Italy football is always a protagonist.

The conclusion is to use at least dual-factor authentication for any of your accounts containing sensitive data. That means for every account.

About the Author

Rocco Gagliardi has been working in IT since the 1980s and specialized in IT security in the 1990s. His main focus lies in security frameworks, network routing, firewalling and log management.

Links

• https://www.andreafortuna.org/cybersecurity/the-liberomail-users-database-was-breached/