Password Study: Most Sites Inadequate On Security

A new study reviewed security among leading online companies following the Heartbleed bug scare, in which a commonly used encryption technique for secure websites had the capability to expose highly confidential data.

The study comes from Dashlane, a password management firm. The study evaluated 80 web sites and examined 6 factors with regard to the way passwords and login processes are handled. Using these details, Dashlane ranked each site between +100 and minus -100.

Based on a range of security issues, the study suggests Apple and Microsoft have the securest policies for passwords, while dating site Match.com earned the lowest rankings, with Amazon trailing not too far behind.

Most Sites Inadequate On Security, Study Suggests

According to Dashlane, a site that scored +50 or more could be considered as adequately secure. However, 80 percent of sites in the study failed to meet this threshold. (Source: nbcnews.com)

The only perfect ranking of +100 went to Apple. It was followed by Windows Live / Hotmail with +85, and Microsoft Store and UPS with +75. Ironically the two sites both with +70 were security software giant Kaspersky and Target; the latter was a victim of a spectacular credit card data heist last year. (Source: dashlane.com)

Match.com's ranking of -70 was followed by Hulu and Overstock with -55 and furniture designers Fab with -55. Several firms had a ranking of -45 including the world's largest online retailer, Amazon.com.

Dashlane Study Scrutinizes Six Security Factors

The first factor the study looked at was the minimum password length required on the site. It's particularly important, as every added character makes a password at least 36 times safer (based on 26 letters and 10 digits), or more if symbols are allowed. The second factor was whether the site required alphanumeric passwords, meaning users had to include at least one letter and one number in the password.

The third factor is whether the site displays a "strength meter" when customers are creating a password, which can encourage users to choose a more complex and thus secure option. The fourth factor was whether the site required users to confirm a password change by responding to an email.

The fifth factor was whether an account was automatically locked out if a user made 10 consecutive incorrect attempts at typing a password. The sixth factor was the simple issue of whether a site allowed users to choose "password" as their password.

Aside from using the email verification for changed passwords, Match.com failed on every measure in the study. It even allowed a single character password such as "a".

What's Your Opinion?

Does a website's password requirements affect your decision on whether or not you use the web site? Do you go above and beyond the minimum requirements of a site when choosing a password? Would you favor industry standards among online retailers so that big name firms are not allowed to permit weak passwords? Lastly, do you use an automated password generating program, such as Roboform to securely generate and store your passwords?