Bad Password Rule

Share bad password rules and who wrote them

[Bad Password Rule @BadPasswordRule]

This is how you do it! Only pw rules that add security. Plus a security "meter". Fun fact: even 64 chars long, a password of all `a` doesn't pass security meter and enable button. #goodpasswordrule @cartainc

[MassMutual @massmutual]

@BadPasswordRule Hi, Thank you for your feedback. We have passed this along to our dev team. thx, Jay @ MassMutual

[@levelsio @levelsio]

@Authy It's a golden rule: you never want to have a single attack vector to break all your security. Password managers are just as bad an idea.

[matt blaze @mattblaze]

More cargo cult password rules: making the user change their password if there were too many bad login attempts.

[Bad Password Rule @BadPasswordRule]

@TriNet

[Emma Lilliestam @emalstm]

Why are so many password rules bad and arbitrarily? Because... reasons.
https://t.co/65zLE9Gp97

[Bad Password Rule @BadPasswordRule]

@massmutual ...Worse part is new pw field doesn't error if you copy paste more than 12 chars. So when you go to use new pw, login fails =( https://t.co/sVqDoRD0Kx

[Bad Password Rule @BadPasswordRule]

@massmutual 12 chars max? Why?...

[Bad Password Rule @BadPasswordRule]

@massmutual 12 chars max? Why?...

[Bad Password Rule @BadPasswordRule]

;) https://t.co/GG9hqucMTm

[🏳️‍🌈🇬🇧🇪🇺🎭 @obstructdviews]

I was about to register with @SW_Trains, but then I saw their password rules... #BadPasswordRules

[Benjamin Smedberg @nsIAnswers]

Gah password rule "no spaces allowed". #antisecurity

[Cheri @AnimatedHokie]

You fuckin retarded, @comcastcares? Did you change rule on what length pword need to be? CANT CHANGE NEW PASSWORD BECAUSE OLD IS TOO SHORT⁉️

[Bad Password Rule @BadPasswordRule]

@USPS @USPSHelp Rules that make passwords LESS random are less secure.

[(((Jacob Mars))) @MistaTurn]

@Aetna Your password rules just rejected 50 character securely generated password because some characters repeat. #BadPasswordRules

[(((Jacob Mars))) @MistaTurn]

@Aetna Also, your password rules are limited to 20 characters (bad!) and the error doesn't report that. #BadPasswordRules

[Julia Angwin @JuliaAngwin]

NIST’s password guidance is good advice. Longer and unique is better. Hints, expiration and composition rules are bad. https://t.co/wqei3qWSbP

[Graeme Cole (@graemecole.bsky.social) @elocemearg]

Top 3 stupid password rules.
Bad: "must contain a symbol"
Worse: "must change every 3 months"
Worst: "cannot exceed 12 characters"

[Lars Osborne🔥🚀 (Hydrazine Enjoyer) @lars_0]

WebDev's underestimate pain caused by bad password generation pages. Feeding pw rules to users one at a time sucks! A lot of people give up.

[Bad Password Rule @BadPasswordRule]

@AppleSupport thx this helped

[Bad Password Rule @BadPasswordRule]

@SRTA_PeachPass srsly?