The Hotmail hack attack this week has laid bare the woeful password choices of web users, as reports emerged that up to 1 million web email accounts could have been compromised.

The most common password was "123456", while many users had names or dates of birth - all easy pickings for the determined password cracker.

Password security was thrown into the spotlight this week after it was revealed that 10,000 Hotmail user names and passwords had been leaked online. A day later, a separate list of 20,000 addresses and passwords for Gmail, Yahoo and AOL were found on the web.

The size of the lists, one of which contains only email addresses beginning with A and B, have led security experts to fear that thousands more accounts have been compromised.

Hackers frequently target email accounts because from there they can obtain passwords to other more important accounts such as internet banking. Often, the same password is used for multiple online accounts.

Hijacked email addresses are also used to conduct spam campaigns and targeted phishing attacks on the victim's contacts. Security firm Websense reported that some of the addresses compromised this week were already being used for this purpose.

Full article