After princesses, Mozilla now has ‘Superhero passwords’ warning for you – Times of India

Superhero passwords are bad for you online, warns Mozilla. In a blog post, the company said that superhero-based passwords are increasingly showing up in datasets of hacked information. Mozilla‘s analysis is based on data from haveibeenpwned.com.
These passwords have reportedly been found in the hacked datasets running into multiple thousands. As per the Mozilla blog, Superman showed up in 368,397 breaches, followed by Batman in 226,327, Spider-Man in 160,030, Wolverine in 53,745 and Ironman in 44,175 breaches. These together make up the top 5. The other names in this ‘worst superheroes passwords’ list are: Wonder Woman, Blackk Panther, Daredevil, Thor, Captain America and Black Widow.
This means that if you have Superman, Batman, Spider-Man or any of these superhero name as your password, do change it before it is too late.
Incidentally, in 2019 too Moilla did a similar study with Princess passwords. Named ‘Princesses make terrible passwords for Disney+ and every other account,’ this study blog claimed how bad the choice of these royal princesses name as password could be. This list included: Aurora, Cinderella, Belle, Ariel, Snowwhite, Pocahontas, Merida, Rapunzel, Tiana, Mulan and Moana.
Mozilla published this blog after thousands of Disney customers complained that they have been hacked after signing up to the company’s online streaming service in November 2019. However, Disney maintained that it does not believe that its systems have been compromised. While what exactly led to the Disney+ account hack isn’t totally clear, Mozilla said that this may be the result of weak and reused passwords.
“If you used the same password for an account that was previously breached as you did for your Disney+ password, a bad actor could gain access. Furthermore, hackers with stolen datasets at their fingertips could easily filter on key terms to find the Disney fans. Just look how many times the 12 Disney princesses showed up in breached datasets, according to haveibeenpwned.com,” said the blog post.