Passwords have always been a weak point in security, but things may be looking up for security professionals. In fact, a recent Duo Labs study suggested that users’ password habits are improving.

Researchers analyzed the Anti Public Combo List (APCL), which consists of 562,077,487 usernames and passwords aggregated from various large-scale data breaches and password dumps. They found that users were beginning to adopt certain recommended standards for password security, such as minimum character length. The list is associated with a cybercriminal tool that is used to verify the legitimacy of compromised credentials by using APCL as its source.

An ‘Uncommonly Large’ Picture of Password Security

Because the list comes from multiple sources, Duo Labs admitted that such an analysis does not reveal deep insights into user security behavior. However, it still offers an “uncommonly large view into broad user security choices,” the firm said.

The study found that 42 percent of the usernames listed as APCL members ended in yahoo.com, while 7 percent ended in aol.com. From this, they concluded that the list was a consumer-heavy dataset. Another 8 percent of the APCL consisted of duplicate addresses. This indicated that the list was actually a collection of individual dumps that was derived from separate sources and was very consumer heavy.

After all was said and done, Duo Labs found that 51 percent of the APCL user accounts were some variation of Yahoo or Yahoo Mail accounts. The firm then eliminated domains that are used for consumer email, and found that only about 1 million, or 1.7 percent, of the accounts on the list came from the domain space of large companies.

Lengthen Passwords to Strengthen Security

According to the researchers, password length peaked at nine characters. This is longer than the National Institute of Standards and Technology’s (NIST) eight-character recommendation, showing that users and enterprises are taking this step seriously.

However, the actual content of a password still affects how easily it can be broken. For example, a password consisting of all lowercase characters is easier to break than one that contains lowercase and uppercase characters, plus numbers and symbols.

Duo Labs found that only 6 percent of the passwords contained at least one uppercase character, while just 4 percent contained a symbol. This was not the case for numbers: 70 percent of passwords included at least one, and the mean number of numeric characters per password was 2.3.

Individual users and organizations are beginning to follow the NIST-recommended password standards, but improvement is still needed. Strengthening the content of passwords will make them harder to crack as cybercriminals inevitably improve their credential-breaking techniques.