Thought ‘ji32k-7au4a83’ was a unique, secure password? Experts don't agree

By Rohan Abraham

Choosing a password is no child’s play. Some uncommon combinations can also be vulnerable to breaches. Experts suggest a cautionary approach while creating and managing your passwords.

People around the world behave in a similar fashion while choosing passwords. They often pick phrases that are easy to remember, such as names of family members and pets, or modifications of simple words like ‘welcome’ or ‘password’.

Common sense suggests that ‘ji32k-7au4a83’ is unlikely to belong to the lexicon of universal puppy names. However, the seemingly complex jumble can be reduced to a deceptively simple phrase.


In the latest list of vulnerable passwords published by the data-breach website HIBP, the alphanumeric combination ‘ji32k-7au4a83’ showed up more frequently than expected. The mystery behind its popularity is more a tale of shared tendencies, rather than one of deviant digital behaviour.

Character coding
David A Bader, Chair of the School of Computational Science and Engineering at the Georgia Institute of Technology, believes that the solution to the riddle lies in the way people from non-English-speaking countries communicate over the internet. “The random password that has been found to be vulnerable by HIBP is actually the transliteration of ‘my password’ by the Zhuyin Fuhao system, used in Taiwan for converting Mandarin to Unicode,” Bader told ETPanache. Unicode is the established encoding standard for the digitisation of the world’s languages — from Catalan to Javanese.

Local threat
First-time internet users from the hinterlands of India are going online in vernacular languages and their poor password habits could jeopardise the country’s nascent digital payments sector. “With applications like the Google Indic keyboard gaining popularity in India, the use of scripts such as Devanagari to set passwords can present a similar vulnerability,” said Roman V Yampolskiy, an expert on behavioural biometrics and cyber-security.

A Google representative told ETPanache that keystroke data gleaned from its Indic keyboard app is stored locally on the user’s device. He said user data is not being shared with Google or third parties for fine-tuning its auto-correct and predictive text features.

Digital cleansing
“Since India uses both English and Hindi for official documentation, clear advice should be given to government officials and bureaucrats on the selection and use of passwords,” cautioned Bader. He recommended a long random sequence of letters, numbers and special characters, but stressed the importance of uniqueness.

Even though a food delivery app and a music streaming service may not have anything in common, setting a common password can expose one’s banking credentials to hackers if there is a breach at either end.

Ripple effects
A breach at a streaming app will put more than one’s taste in music under scrutiny. Hackers will be able to track down a user’s physical address by checking the order log from previous transactions made using the food delivery app.

The compromise can be furthered if a common pool of passwords is being recycled across websites. Yampolskiy endorses a cautionary approach coupled with diligence while maintaining a repository of current and past passwords. “A secure password safe may also help keep your online information safe from hackers,” he added.