Some passwords like "123456", "admin" are outrageously popular, so are the leet transformations and concatenation of digits.
The users seem to pick up the password suggestions or just copy the passwords pattern of others without giving a thought. The passwords should remain secret, but the fact that passwords of different users in many leaked databases are found to be same or similar indicates that the passwords do not remain secret. Is this just a coincidence that users are using the same password or same rules to transform the password?
The password trend seems to be propagated from users to users as today information get propagated through the internet. This trend also reaches the potential attacker and as a result, in case of the password database is leaked, the cracker succeeds. The passwords that are not cracked, do not follow the popular trend and are thus spared by the cracker.
It is often argued that the human choose passwords that are easy to remember. But the fact that nearly 300,000 Rockyou users used password "123456" indicates that either most of the users simply imitate others in some way for creating the passwords or is it the case that the word generator in the human mind is biased. Learning by imitation is an evolutionary feature. But passwords creation needs uniqueness and not imitation.
So, is this the limitation of human mind (either imitation or biased word generator), when it comes to the password creation?
To prevent the influence of the password propagation, can we give unique suggestions to each user for the password creation? Composition rules applies to each user of that website, can it be altered to each user?