Study Publisher: Joseph Bonneau
Study Date: February 9 2011
Study URL: http://www.lightbluetouchpaper.org/2011/02/09/measuring-password-re-use-empirically/

Study Overview:
Analyzed data from the Rootkit.com hashed password dump from February 2011 containing around 81,000 accounts, and the Gawker hashed password dump from December 2010 containing around 748,490 accounts with passwords. Compared passwords of 456 matching email addresses after filtering out some throwaway addresses. The passwords of accounts on both sites were cracked for 161 users.

Statistics From This Study:

• Actual password reuse between two breached web sites with hashed passwords