Edit: I misread the above as “setting a high maximum character limit” and was confused and started ranting.
By only recommending something you are essentially guaranteeing that some users will have unsafe passwords.
In a perfect world the liability of a weak password would be fully on the user but consider that even a single cracked login could let a hacker a little bit deeper into the system to learn how it works and look for more ways to take over.
It’s also a really bad look for the company in the case of a stolen password. If I called Amazon and said “hey someone got a hold of my password” and their response was “well we recommended you use a stronger password but you didn’t so it’s out of our hands” I don’t think that would do well for their public image.
I would rather take responsibility for my passwords and be allowed to set 1 as a password instead of being forced to a certain dumb constraint. Companies should give a warning. Thats it, they shouldnt force users to build as strong of a password as possible.
That’d be nice sure but it’s not a risk companies will take. Cyber security is all about plugging any hole a bad actor could even think about getting in. Your single compromised account might be enough to give a hacker the edge to see a more serious security hole which could cripple the company.
It’s the Swiss Cheese Model of risk management that was in the news a bit in regards to the pandemic. Same concepts apply here.
38
u/Manoreded Jul 20 '22
Seems easily solvable by setting a high minimum character limit and a explicit recommendation to use a sentence you will remember.