Largest Study of its Kind Shows Outdated Password Practices are Widespread | College of Computing
www.cc.gatech.edu

Largest Study of its Kind Shows Outdated Password Practices are Widespread::undefined

  • lolola@lemmy.blahaj.zoneEnglish
    90·
    9 months ago

    The article focuses on password requirements that websites implement, not user behaviors. Common bad practices mentioned:

    • Permit very short passwords
    • Do not block common passwords
    • Use outdated requirements like complex characters
      • lolola@lemmy.blahaj.zoneEnglish
        1·
        9 months ago

        I copied the list straight from the article, so excuse the awkward phrasing. But yes, the implication is that you could totally use “password1” on some websites.

  • gregorum@lemm.eeEnglish
    403·
    9 months ago

    Largest study ever confirms something everyone has always known

      • fakeaustinfloyd@ttrpg.networkEnglish
        1·
        9 months ago

        It is possible that you have a bad infosec team; however, it is more likely that they need to meet outdated compliance goals (SOC 2 comes to mind here).

        Infosec is unfortunately a tricky balancing act of compliance, security, and usability.

  • Dem Bosain@midwest.socialEnglish
    18·
    9 months ago

    I am tired of websites imposing limitations on passwords, but not sharing what those are. I use a password generator, and rarely know if Unicode characters are allowed, if there’s a limit on the number of characters, etc.

    I’ve come across websites where dashes “-” are forbidden. My banking website only allows a maximum of 16 characters. Sometimes there’s a note below the password box, sometimes they don’t tell you until your password fails, and sometimes they don’t ever tell you. If I don’t know what the restrictions are, I’ll end up throwing a cheap password at it until I can find out what’s acceptable.

    • Altima NEO@lemmy.zipEnglish
      4·
      9 months ago

      Sometimes they change the requirements, so a password that once had symbols no longer works, and you can’t log in anymore.

      • Nommer@sh.itjust.worksEnglish
        2·
        9 months ago

        Even better! They’ll sometimes tell you the wrong error message like my bank used to before they redesigned the front end and backend. I couldn’t change my password there for the longest time because it kept telling me my password was not between 5-8 characters long (yes it was). Turns out I couldn’t use a - in my password. I’m glad they finally updated to to a longer password but I still can’t use a - in my password.

    • numanair@lemmy.mlEnglish
      3·
      9 months ago

      Sometimes the limits they tell you are wrong. Sometimes they truncate your password without telling you. Sometimes the app has different requirements than the website.

    • GrunerAffe@lemmynsfw.comEnglish
      2·
      9 months ago

      Banking having the incredibly low character max is insane. I made a new account recently and I wanted to use the Bitwarden passphrase generation, but even 2 words could make it too long. Plus the push for 2 factor auth with everything including crap like streaming, except they just want to email me after I’ve given my very strong passwords already…

  • Sanctus@lemmy.worldEnglish
    64·
    9 months ago

    Passkeys and OTPs should be the new standard. Passwords are obsolete and passphrases are too hard for the average cumsoomer.

    • bitwolf@lemmy.oneEnglish
      2·
      9 months ago

      Yes. They really need to play hardball like they did with chip and pin credit card input.

      (If your data is stolen and the vendor did not support chip and pin they were liable for the damages.)