A report released today by database security vendor Imperva Inc. serves as another reminder of why IT administrators need to enforce strong password policies on applications and systems.

Imperva's report is based on an analysis of 32 million passwords that were exposed in a recent database intrusion at a developer of several popular Facebook applications. The passwords belonged to users who had registered with RockYou and had been stored by the company in clear text on the compromised database. The hacker responsible for the intrusion later posted the entire list of 32 million passwords on the Internet.

An analysis of that list provides the latest confirmation that a majority of users still don't care about the strength of their passwords if they are left to choose on their own.

According to Imperva, about 30% of the passwords in the hacked list were six characters or smaller, while 60% were passwords created from a limited set of alpha-numeric characters. Nearly 50% of the users had used easily guessable names, common slang words, adjacent keyboard keys and consecutive digits as their passwords.

In fact the most common password among RockYou users was "123456" followed by "12345" and "123456789." The other passwords rounding out the top five were "password" and "iloveyou."