I frequently encounter questions about the reasons behind password policies and restrictions (Example1, Example2), the easiest example being the maximum length restrictions. The overwhelming consensus is that these policies are almost entirely bad and/or indications of bad behind-the-scenes password management.

However, several prominent companies for which I have usernames/passwords still have these password policies. I am concerned, in particular, because several of these companies keep or transmit money.

So: Regardless of why a particular company has these bad policies, is there a way to get a company, sometimes a large, sluggish corporation, to get their password management up-to-date?

I am looking for concrete methods or routes to use (are these companies risking violating consumer protection laws? can their IT departments be found and interviewed at a security conference?), not vague answers like "start a Facebook movement to publicly ridicule the company."

  • 1
    Simple answer? No. In any case, with only very rare exceptions, these constraints are virtually always irrelevant when it comes to your ability to create and use a "strong-enough" random password.
    – Xander
    Sep 26, 2016 at 22:13
  • I agree with @Xander. The reasons they keep them are generally because that's how the app was written and it takes years and lots of money to get them changed for all sorts of reasons, some even genuine! And all of that for something that may not improve the bottom line - it is all based on risk/reward analysis. Though having said that, there is certainly merit in trying to embarrass them to change through careful public comms. Sep 26, 2016 at 22:35
  • Not really, ad they often can't perceive it as the problem that it is. Sep 26, 2016 at 23:23
  • You send a short, polite email explaining that you are an information security expert and that as a customer you would appreciate if they could change their password policy. You then recieve a polite response from customer support conatining vague statements about how important security is for the company. You sigh and move on with your life.
    – Anders
    Sep 27, 2016 at 9:20


You must log in to answer this question.

Browse other questions tagged .