Password policies of most top websites fail to follow best practices
summary
Analysis of 120 popular sites finds only 13% follow all relevant best practices and only 22 sites block most leaked passwords; 71 sites accept all 40 tested weak passwords, including many storing PII or payment data. Strength meters appear on just 23 sites and nearly half misuse them to nudge specific character classes. Fifty four sites require character classes and overall 45% impose composition rules, producing both insecure acceptance and confusing rejection behavior.
AI-written summary · about
chapters (5)
- 0:00Start
- 0:21Passwords aren't going anywhere
- 2:02Souly:Are websites preventing setting the most common passwords?
- 4:07Study 2: Strength meters are not measuring guessability
- 8:44Recap
related talks
27mThe Wide Diversity of Password Requirements – And how to cope with it
23mFantastic Passwords and Where to Find Them
46mRequiem for the Password
40mFantastic Passwords and Where to Find Them
25mEverything You Know About Passwords Is Wrong
47mYour Password Complexity Requirements are Worthless
05mPlease do not use !?_ or your License Plate Number: Analyzing Password Policies in
31mBreaking Bad (Passwords)