And still this is yet another hacking that has little to do with choosing a bad password but with the use of the wrong algorithm to store it (md5) and poor implementation of security on the server.
The back-end could be using bcrypt with a ridiculous work factor, and server security could be state of the art, but choosing your phone number as a password will always be a poor decision.
Always? OK, I've reset my HN password to [one of] my phone number. So you can log in as me now?
No of course you can't. You don't even know how many digits it is, did I include + for an international number, did I use brackets, hyphens, dots (comme une gars Francais)? How will you connect my online ID with my phone number¹?
Once you have my password what are you going to do? Right flames and lose me karma? I can just start a new account if needs be, nothing lost really.
For many accounts a phone number is probably a good enough password IMO. For accounts that handle money? No way. For email accounts that receive reset passwords? Not a chance. For posting drivel on tech chat forums ... it'll be fine!
--
¹ If you can I'd prefer you didn't print it.
Interestingly I searched for the numbers as I'd use them along with a substring of my username and didn't find them. Did you really Google or were you using the term generically? I tried both Google and Bing.
Well done now you can destroy my HN karma (no not really).
The seomoz profile lists a couple of websites. One of those sites has a phone number on the /contact page, and the /about page on the other links to another business (not totally sure how I originally found that, but this is currently the quickest way to get there.)
That business has a couple more phone numbers listed on their homepage, which also matches the phone numbers on the shopfront on google street view.
This can also be cross-checked with whois.
A bit more googling (literally) of your names found an alternative (possibly old?) address in the same town, and googling that pulled up a fourth number.
I never used to give away my location but got tired of anonymity for it's own sake. Think I'll be reviewing my online exposure now. It's been something I've worried over a little recently but it's hard to keep work/home separate (which I prefer) in many ways. Thanks for getting back to me.
I implement this personally by keeping my GPG keypair available, encrypting an email to myself with the relevant login information, and pulling this email up when I need to log in. In most cases it's a simple copy and paste operation and that works great. :)
This is going to be an ongoing problem until someone makes it extremely easy for either one side or the other to implement it correctly. With so many divergent development technologies, I reckon it will be much easier to achieve this kind of safety on the client side than the developer side -- LastPass et al are good steps.
There has to be a compromise somewhere. Users will have to accept one day that if they don't want important digital data stolen, they are going to have to personally become serious about password security, unless someone finds magic "fix every computer system's password storage methodology" dust somewhere. In the meantime, a user is welcome to be reckless and he can see which method he prefers.
I am just saying that every other week there is a new blog post with password analysis of leaked passwords: how many are 123456 and blah blah blah. I think it's time to cut some slack to the users and start blame HEAVILY whoever is taking care of the system or programming the service.
(BTW: you'd be better off using supergenpass or stanford PwdHash)