The global digital giant's services like facebook/gmail/twitter/etc are not following standard password policies (like the standard password policies used by most of the Enterprises/Corporate).

For example there are no password expiry on these services (I'm using the passwords I created years back) and some of the passwords are not complex enough...

I believe these organizations are liable for the PII (Personal Identifiable Information) of users, hence the question is are risking them self (and users's data) by ignoring standard industry password policies/practices?

Or they manage it through some other mechanisms? Am I missing something here?

  • 1
    To be clear, are you saying Facebook/Google/Twitter can be held liable if a customer uses a bad password and then gets "hacked"? Or are you asking about password policies for employees leading to customer data being stolen? Sep 19, 2018 at 2:25
  • As responsible service provider, why can't they implement some best practices to enhance the security of their users? Or they are doing it in different ways? Believe most of they are responsible for customer data...
    – Sayan
    Sep 19, 2018 at 15:20
  • 1
    Incidentally, most business/enterprise are currently not following best practices. Actually Google and Facebook are closer to following best practice. In particular: requiring a mix of letters/symbols/numbers and required periodic password changes are NOT recommended anymore. Things that ARE recommended: don't impose short password maximum length (my place of work limited me to 12 characters up until a few years ago), DO require a long minimum length (e.g. 12 or 14 characters minimum), and DO check any passwords against a list of known weak passwords.
    – Ben
    Sep 19, 2018 at 15:29

2 Answers 2


IANAL, but in my opinion a service is only liable for what it manages. So they shall ensure that only authorized admins can access PII, and strictly forbid it.

On the other hand, the password is chosen by the users, and the password security is under their control. ANY ACCESS USING THE PASSWORD IS SUPPOSED TO BE A LEGITIMATE ONE. Full stop.

The various password policies should be seen as a way to educate corporate users to security practices, by their intrinsic efficacity is often debated, including on SE site. Search for password policy for more...


If the threat is that someone might steal or guess your password, and then access your data, then it can be mitigated in various ways. I think Google for example checks the location and device that tries to log it, and if they notice something unusual (like signing up from a different region), they block the access and ask a security question or force you to use 2FA. I also just tried to create an account on Google, and they won't let me use a simple password like "123" (8 characters are required, etc.). I'm also pretty sure it limits the attempts in case someone wanted to guess you password, although I haven't tried this. As you can see, Google does try to mitigate this threat. Forcing a user to change passwords regularly might not be useful at all, if you consider that other mitigations are already implemented and that being forced to change passwords is often considered a pain by the user.

However, if a service (Google, Facebook, whatever) allowed users to sign in using very weak passwords like "123", I believe it would be such a bad practice that it would really put users at risk, even if other ways of mitigating the threat were implemented. It would not be acceptable. I haven't checked if any major services allow this, I hope not. I don't know if any of this can be considered "illegal" or not, anyway. All I can tell you is that in the European Union, the GDPR (General Data Protection Regulation) says that you must take data protection seriously when you process personal data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .