Believe it or not, there are still plenty of people out there using passwords like “password,” “password123,” “[dog name] 1,” and the like. And in an age where hacking is becoming increasingly sophisticated, these passwords aren’t what we would define as “secure.”.
Before we hear or read it elsewhere, websites themselves should be making sure to inform us when creating a password. But it seems that many big names aren't giving enough warning to encourage stronger passwords, according to a new study.
Steve Furnell from the University of Plymouth has been monitoring websites such as Amazon, Reddit and Wikipedia for many years, carrying out assessments in 2007, 2011 and 2014.
The 2018 study looked at the practices of Google, Facebook, Wikipedia, Reddit, Yahoo, Amazon, Twitter, Instagram, Microsoft Live, and Netflix. The study concluded that Amazon had the worst performance of all. It accepted almost any type of password of any length. On the other hand, Yahoo and Wikipedia even allowed passwords with a single character!
In contrast, the survey observed that Google, Yahoo and Microsoft have shown improvements in password practices since the last study in 2014.
Steve finds it concerning that after a decade of constant exposure of this issue, major websites on the Internet are not encouraging strong passwords in the era of global cyberattacks. However, what could be seen as a positive is the increasing presence of options such as two-step verification and two-factor authentication, among others.
“With a gap of more than ten years between studies, it is somewhat disappointing to find that the overall picture of the password landscape in 2018 remains largely similar to that of 2007. In the intervening years, much has been written about the failings of passwords and the ways in which we use them, but little has been done to encourage users to follow the right path,” Steve says in his research.
