For work and other official matters, I am often forced to use websites and apps which clearly have some kind of cargo cult going on in their security department, given that they impose extremely foolish requirements on passwords:
- Character requirements like "at least one number, at least uppercase, at least one lowercase, at least one one symbol, at least one ancient egyptian hieroglyphic, at least one mathematical symbol unknown to people with less than 3 years of graduate-level math training..."
- Inane pattern requirements like "no repeating the same letter"
- Nonsense length restrictions, like "8-16 chars"
- Disabling copy/paste in the password form
- Forced password rotation at short intervals, eg. 30 days, for trivial accounts
Security is of course always important, but bear in mind that I'm not talking here about the nuclear launch codes or entry to the vault at Fort Knox. I am speaking of the vast majority of my accounts that have relatively trivial importance, such as my library card, toll card for my car, health insurance portal, airline rewards account and so on. Being that I am a knowledgeable and intelligent person who already follows sufficient password security best practices, I find this style of user-hostile "security" to be present several problems:
- It arbitrarily restricts the password universe, reduces password entropy and thereby makes my secure password less secure
- It sometimes makes it impossible to create a secure password (eg. very short max length)
- It makes it very difficult to use a password manager
- It makes it very difficult to follow a uniform password policy across my countless accounts
I think there is some kind of arms race going on in the security business because these have gotten progressively worse over the recent years as more and more B2B tech startups enter the marketplace and try to "disrupt" their respective industry.
Ordinarily, my response to such nonsense is to patronize a competing business with a saner approach to security. However sometimes I am forced into working with a certain company (ie. I can't get my employer to single handedly change their HR solution) or virtually all competitors also engage in the same practice. Besides this being extremely onerous, I am also becoming very concerned about the actual security of the accounts themselves. I feel like if my solution is to keep fiddling with my password generator some more and move on, the company never receives negative feedback on their misguided practice, and the problem becomes worse.
What can I realistically do, as a user, to counteract this most effectively? Is sending a strongly worded letter my best option here?