<story><title>86% of CrashCrate subscribers used passwords already leaked in other breaches</title><url>https://www.troyhunt.com/86-of-passwords-are-terrible-and-other-statistics/</url></story><parent_chain><item><author>charDiversity</author><text>When I feel like a security goon&amp;#x27;s arbitrary and capricious password policy is irrational and counterproductive, I make my passwords worse in the hopes that I have to someday read it to someone, or perhaps it gets spilt outin the open, and then everyone will see how forcing me to pick a password that adheres to certain characteristics solved nothing.&lt;p&gt;Just wait. Someday you will see dumps of pwnt password that look like:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  Password-1234
  Password_1234
  Password!1234
  Password&amp;amp;1234
  Password?1234
  Password$1234
&lt;/code&gt;&lt;/pre&gt;
And that is rated as a &amp;quot;&lt;i&gt;VERY STRONG&lt;/i&gt;&amp;quot; password.&lt;p&gt;Have fun with your character diversity, and your 90 day password expiration rotation schemes. Go ahead and try to force me into a corner. I&amp;#x27;m still picking terrible passwords and I&amp;#x27;m picking especially terrible ones because someone out there is trying to pull my strings.&lt;p&gt;Pull my strings. Make me more predictable within your little security policy world. See how that plays out.</text></item></parent_chain><comment><author>Avamander</author><text>Just recently Estonian Information System Authority published a new report (including new guidelines for passwords) basically telling: &amp;quot;Drop password requirements, allow long passwords and restrict the use of short and top-n passwords&amp;quot;.&lt;p&gt;Why I&amp;#x27;m mentioning this is because now I have an actual official document I can send to Estonian companies in addition to my own words (that weren&amp;#x27;t previously believed, ugh) why their requirements are inane. I think this kind of behaviour shows that we actually need some kind of monitoring or regulation here to build more secure software for everyone.&lt;p&gt;Also as you mentioned bad-&amp;quot;strong&amp;quot; passwords, I &amp;quot;love&amp;quot; how something like &amp;quot;Qwerty!1234&amp;quot; satisfies most requirements but &amp;quot;8f434346648f6b96df89dda901c5176b10a6d83961dd3c1ac88b59b2dc327aa4&amp;quot; is not okay because it doesn&amp;#x27;t contain an uppercase letter or a symbol.</text></comment>
<story><title>86% of CrashCrate subscribers used passwords already leaked in other breaches</title><url>https://www.troyhunt.com/86-of-passwords-are-terrible-and-other-statistics/</url></story><parent_chain><item><author>charDiversity</author><text>When I feel like a security goon&amp;#x27;s arbitrary and capricious password policy is irrational and counterproductive, I make my passwords worse in the hopes that I have to someday read it to someone, or perhaps it gets spilt outin the open, and then everyone will see how forcing me to pick a password that adheres to certain characteristics solved nothing.&lt;p&gt;Just wait. Someday you will see dumps of pwnt password that look like:&lt;p&gt;&lt;pre&gt;&lt;code&gt;  Password-1234
  Password_1234
  Password!1234
  Password&amp;amp;1234
  Password?1234
  Password$1234
&lt;/code&gt;&lt;/pre&gt;
And that is rated as a &amp;quot;&lt;i&gt;VERY STRONG&lt;/i&gt;&amp;quot; password.&lt;p&gt;Have fun with your character diversity, and your 90 day password expiration rotation schemes. Go ahead and try to force me into a corner. I&amp;#x27;m still picking terrible passwords and I&amp;#x27;m picking especially terrible ones because someone out there is trying to pull my strings.&lt;p&gt;Pull my strings. Make me more predictable within your little security policy world. See how that plays out.</text></item></parent_chain><comment><author>dudul</author><text>I completely agree.  &amp;quot;Your password must be at least 10 character long, include 2 upper case, 2 lower case, 2 digits, 2 special characters, must be changed every 60 days and cannot be reused for the next 3 years&amp;quot;&lt;p&gt;G0Fuc4Y@urse!f&lt;p&gt;To me this is a sure way that people are gonna pick horrible and stupid passwords.</text></comment>