I know that there are some common passwords like
Password. These are very insecure since everybody knows to try them first.
It is commonly thought that passwords derived from the username alone are also insecure. For instance, setting the password to the same as the username is often accepted a bad idea. Simple functions (eg the username backwards) would in theory also offer little added security - is there any research on which such functions for deriving a password based on the username are the most common?