DRG SSH Username and Password Authentication Tag Clouds

Thanks to Bruce Schneier for covering this.

I thought this (also) relevant:

Good catch! I'd actually love to find out exactly what the sources of this data are. The authors of the visualization should provide a description on that page I think. It seems like it's being pulled from observations of brute force attack attempts in the wild (as the graph is supposedly being updated hourly). If that's the case, it won't correlate so much with actual credentials in use, unless we view brute force scanner developers as having top-notch knowledge about the matter. If, OTOH, only successful authentications are being considered, then that might give this more weight (albeit still not enough to make conclusions about actual credential popularity).

When I have seen this kind of thing before (& I've never seen it done as a tag cloud, which was neat) it has usually been from honeypot research, so that is better described as the most popular with the bad guys to try to attack, rather than the passwords/usernames most frequently used in the real world.

I don't really see how you could do anything else to get this information, but I am probably overlooking something cunning, as usual...