Julian Assange, founder of Wikileaks, said in a recent interview with Sean Hannity that John Podesta’s password was 'password'.
The Daily Mail reports:
In an interview, Assange revealed the campaign chairman's password was 'password' and that he had responded to phishing emails.
Was Podesta's email password just "password"?
(With analysis thanks to Oddthinking)
Assange seems to refer to this leaked email from Podesta's assistant Eryn Sapp to him, which contained an username and password for him to use. (This was not necessarily for his email account.)
While sending a password through plaintext is bad form in general, it is entirely possible that this was meant to be a temporary password. There is no public evidence that Podesta failed to change his password after he got this email.
On the other hand, the general belief among security and media experts is that Podesta was hacked by a simple, if authentic-looking, phishing email. He was suspicious of the email but his security team incorrectly told him that it was "legitimate."
Phishing is an extremely prevalent hacking technique and is not limited to state actors, which adds weight to Assange's overall argument that Podesta's account could have been easily hacked by anyone. But his claim that Podesta was using an easily guessable password is not actually supported by public email evidence.
The current accepted answer has a number of errors, so I'm creating this answer. Thanks to comments by Avery and Oddthinking for some resources.
The source of this claim is apparently a Fox News interview which quotes Assange as saying:
Podesta gave out that his password was the word ‘password’. His own staff said this email that you’ve received, this is totally legitimate. So, this is something ... a 14-year-old kid could have hacked Podesta that way.
Assuming he is referring to some of John Podesta's leaked emails, I was not able to find any instances that properly match the reported description in my search.
It's possible Assange is actually referring to this email in which you can find a similar password (although sent to Podesta, not from Podesta):
2 things
From:[email protected] To: [email protected] Date: 2015-02-19 00:35 Subject: 2 thingsThough CAP is still having issues with my email and computer, yours is good to go.
jpodesta p@ssw0rdI warn you, the Windows 8 system is VERY different from what we had back at the WH. Might require a tutorial. It's an operating system that is best with touch screens, which we obviously don't have. If you need tech's help, they're at x5683. Otherwise, I can show you some tricks when I get in. I have it on my home computer, and it took a while to get used to completely.
Second thing, because of the snow day, my makeup passport appt is tomorrow at 8 am nearby State. No clue how long this takes. If you haven't seen it, earlier I sent you your schedule in an attachment. First thing is Roger Altman at 10:45 am. I'll have my phone the whole time and will check email often.
Obviously, p@ssw0rd is not the same as password, but they are similar enough. What may make this claim disingenuous if not an outright lie, is that if this is the password in question, Assange may be trying to pass this off as the password that John Podesta used for his Google account (for his Gmail email). At least some people have apparently drawn this conclusion.
As we can see in the email, this password was given to Podesta by IT for his Windows 8 account for his local computer (not an email account, as the other answer incorrectly states). It's a safe bet that this was a one-time-use login, and that when he logged in the first time he would be required to change it (standard practice). Even if not, there is no evidence this password was used for his Google account, and generally speaking Google would not allow him to use such a password.
Google takes an active approach to preventing bad password usage, blacklisting and revoking known bad or leaked passwords. Google does not even let users create an account with such passwords (just think of the public ridicule Google would suffer if they did).
Screenshot taken today with p@ssw0rd, but Google has done this for years.
EDIT: The comments inform me that it is possible for a Google Mail for Business admin to set bad passwords, and even optionally not require the user to reset the password (why Google would allow this though, I cannot imagine). It's unclear if the email account in question was such an account, much less that this was done in this case, and it seems quite unlikely.
It is extremely unlikely that the password that was stolen via the targeted spear phishing was actually password, and there is no public evidence to suggest that it was, while there is considerable evidence to the contrary.
Julian Assange gave an interview to Sean Hannity of Fox news. Fox news hosts the transcript on their website. The relevant exchange starts with:
HANNITY: From what we understand, the Podesta emails were hacked through a phishing scheme where it said, Click on this, give us your information, and he did so.
ASSANGE: Well, there's a number of hacks of the DNC and Podesta based on the publicly available information. This is not something coming from our sources. We published, as part of our policy of full disclosure and not interfering with the material...
Here Julian asserts that according to public information multiple people hacked the DNC and hacked Podesta.
Assange makes it clear that he isn't revealing any information that comes from his source about how his source got the data.
He starts to point to his general policy of dealing with sources and that policy isn't to comment about how the source got the information. Given that Assange previously already said that he doesn't reveal any nonpublic information about how Wikileaks got the data, Hannity cuts that explanation off by saying:
HANNITY: Right.
Then Assange starts to commit on the public evidence of how Podesta E-Mails got compromised. It worthwhile at this time to remember that Assange asserts that multiple people hacked it.
It continues with:
ASSANGE: ... we published the -- several Podesta emails which shows Podesta responding to a phishing email. Now, how did they respond?
Podesta gave out that his password was the word "password." His own staff said, This email that you've received, this is totally legitimate. So it's -- so this is something a 14-year-old kid -- a 14-year-old kid could have hacked into Podesta that way.
Assange speaks here about how bad the Clinton campaign was at Cybersecurity. He speaks about why he thinks multiple people hacked Podesta. If the skills of a 14-year old kid are enough to hack the information, that suggests that multiple capable actors hacked the mails.
It's worth remembering what former CIA/NSA director Hayden said about the Clinton hacks:
So, without concrete evidence, which I don’t have, and apparently the FBI doesn’t have either, what I have felt comfortable saying about this is that I would lose a whole lot of respect for a whole bunch of intelligence agencies around the world, if they hadn’t penetrated that server and gotten access to the emails.
Given how bad the information security at the campaign was, Hayden would lose respect for the Russian, the Chinese and maybe other intelligence agencies if they failed to read the mails.
Let's get back to the issue of the password of password. There seems to be no direct public evidence of this being an email password. Given that Assange himself says that he speaks about public evidence it's likely that he speaks about the Windows 8 password that was set to "p@ssw0rd". That means Assange got the facts slightly wrong. An IT system were passwords like "p@ssw0rd" are set is however one that isn't held to high security standards and thus this supports the allegation that the IT security was low enough that Podesta got hacked multiple times.
