Bad Passwords

Calling out dangerous password practices.

[Daniel Friesen @nadir_seen_fire]

Looks like @AuthorizeNet doesn't have insecure @BadPasswords but I would take a "no-symbols" password restriction on sandbox site's passwords over the horrible UX of their password policy.

When you enter a password with symbols other than an unknown set the rules change.

[Bad Passwords @BadPasswords]

What could *possibly* go wrong with sending passwords in clear text? https://t.co/SQ1P0bv2rs

[shenetworks @shenetworks]

When you sign up for an account and they send you a confirmation with your password in clear text 🥴

[Brianna Wu @BriannaWu]

My bank: 🏦: I need you to jump through security hurdles to keep your money safe.
Me: 🙋‍♀️: No problem! Cybersecurity is a process, not a destination!

Also My Bank: 🏦: Whoa, whoa, whoa. 21 digit password? Let's not get crazy. Also, I have never seen the character "&" in my life.

[Daniel Friesen @nadir_seen_fire]

🙄16 characters is the MINIMUM for a good password.

Not the maximum. You got that backwards @costcocanada.

@BadPasswords

[Bad Passwords @BadPasswords]

Oh COME ON!

[Fabio Viggiani @fabio_viggiani]

Username: admin
Password: <blank>
That's not what we meant by passwordless...

[charm ✨ @charmcgi2]

"think of a security question worse than 'What is your mother's maiden name?'"

Fedex: "hold my beer"

[Bad Passwords @BadPasswords]

So wrong!

[Stef @[email protected] Christensen @Wikisteff]

I am have one password that was assigned to me and is 8 characters long. I cannot change it. The password is four seed characters that appear to be constant for each user, and four numeric characters.

It pains me every time I type it in.

[Daniel Friesen @nadir_seen_fire]

BC Hydro: Wonderful, your password is very strong!
Also @bchydro: MAKE IT WEAKER!!!
@BadPasswords

[Brianna Wu @BriannaWu]

Pet peeve: restricting people from pasting in passwords when setting up new accounts.

which do you want it to be? Unique, randomly generated passwords? Or reused ones you can remember. Because the practice heavily encourages the latter.

[Bad Passwords @BadPasswords]

12 characters is long enough for 1995, so @StGeorgeBank is only 25 years behind. #40CharactersOrBust

[Simon Cole @scole01]

Hi @StGeorgeBank your password rules suck. Why can I only have a maximum length password of 12 characters?! And why do you recommend I change my password "regularly to maximise security"?
@TroyHunt @PWTooStrong @BadPasswords @BadPasswordRule @BadPolicies

[miłosz @VeryMilosz]

@keeganjacobson @BadPasswords @BadPolicies Oh, so this has been going on for a while! I just had the same "doh" moment...

https://t.co/mmUIXW9mZm

[Bad Passwords @BadPasswords]

Oh come on!

[LuGoes Tweeting @_Snug_]

@BadPasswords

[James Brooks @jbrooksuk]

Why the weird password rules @GOVUK?