Each year since 2011, the security firm SplashData has released a list of the most commonly used passwords, based on caches of leaked account credentials. The annual list, intended as a reminder of humanity\u2019s poor password practices, always includes predictable entries like \u201cabc123,\u201d \u201c123456,\u201d and \u201cletmein.\u201d But one entry, finishing in the top 20 every year, has stood out since the beginning: "dragon.