Can someone explain the ECB Penguin? I've seen the ECB Penguin used to demonstrate why ECB is not a recommended method of encryption, but I do not understand how this translates to text or passwords.



Aren't the people who create these images comparing apples and oranges?
For a real-world example of precisely the same ECB weakness leading to a massive password compromise, see the Adobe password database leak, as memorably illustrated in the xkcd web comic:
$\hspace{83px}$
(source: xkcd.com)
While there were several issues contributing to the scale of the compromise, one of them was that Adobe, instead of properly hashing the passwords, encrypted them using ECB mode instead.  Even though the attackers apparently did not get the encryption key (or, if they did, they chose not to disclose it), this still exposed several weaknesses that made the passwords much easier to guess:

The length of the encrypted data revealed the length of the password, rounded up to the next 8 bytes.  (This weakness is actually not specific to ECB mode, but I'm including it for completeness.)

Identical passwords produced identical ciphertexts, making it easy to locate frequently reused (and thus presumbaly weak) passwords, and also allowing multiple hints for the same passwords to be correlated as shown in the cartoon above.  (This is a weakness of ECB mode; it would not have happened if the encryption had been done using a semantically secure mode with a proper IV.)

Passwords with the same 8-character prefix yielded ciphertexts with the same first block, making it easier to guess the prefix by comparing hints.  Similarly, any multi-block passwords differing only in some of the blocks would yield partly matching ciphertexts, and any password that happened to contain repeating 8-character blocks (say, &quot;passwordpassword&quot; or &quot;aaaaaaaaaaaaaaaa&quot;) would produce a repetitive ciphertext, just like in the Tux image example.