This dumb password rule is from BMW ConnectedDrive.

Although the prompt suggests good things, after many failed attempts to
set a new password, it turns out you can ONLY use the special characters
shown in the prompt

https://dumbpasswordrules.com/sites/bmw-connecteddrive/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

Hey, were you feeling at all optimistic about anything? Silly you. Brian, @briankrebs, has a new story about a new data leak. Yay! This one is bad. Badder than usual.

Evidence suggests that the data is being exfiltrated from New Orleans-based identity provider idscan.net, even as we speak.

The company provides identity verification services for numerous big brands, including retailers, cannabis dispensaries, car rental companies, financial institutions, et al., with more than 21 million verifications monthly, at more than 20,000 locations around the world.

So, that’s fun! All the deets at Brian’s site:

https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/#more-74231

#krebs #infosec #dataleak #idscan #verification

Well this seems a bit wrong.

I was trying to click on the Support link in the menu, but it seems broken and I clicked on the Open Box link instead.

And that loads a page of crypto casino links.

Im assuming the townew us site has been #hacked.

#Infosec

https://www.townew.us/

This dumb password rule is from SunTrust.

At least there are a variety of special characters to choose from.

https://dumbpasswordrules.com/sites/suntrust/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Lenovo.

- **Between 8 and 20 characters, not more.**
- 1 alphabetic letter
- 1 number (0-9)
- **1 symbol ($!#&)**

https://dumbpasswordrules.com/sites/lenovo/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Eurocircuits.

Minimum 4 and maximum 30 chars. Use only letters (a-z), numbers (0-9) and underscore (_)

https://dumbpasswordrules.com/sites/eurocircuits/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Dwr Cymru (Welsh Water).

Limits password length to a maximum of 16 characters

https://dumbpasswordrules.com/sites/dwr-cymru-welsh-water/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Very.co.uk.

Password field allows *only* the listed Special Characters ($ . , ! % ^ \*).
You're also forced to use both upper, and lower letters, as well as a number.

https://dumbpasswordrules.com/sites/very-co-uk/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from GoDaddy SFTP.

Max 14 characters for the most important password in your shared hosting environment.

https://dumbpasswordrules.com/sites/godaddy-sftp/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

New.

Socket: 13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds https://socket.dev/blog/packagist-themes-ios-spyware @SocketSecurity #infosec #spyware #iOS #Apple

This dumb password rule is from Raiffeisen Bank Serbia.

There are a couple of password limitations when creating a new account (and
changing existing password) on Raiffeisen Bank Serbia on-line banking portal.
Password length is limited to minimum 8 and maximum 32 characters. Also, minimum
uppercase letters 1, minimum lowercase letter 1, minimum digit...

https://dumbpasswordrules.com/sites/raiffeisen-bank-serbia/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

Hey #infosec Mastodon.

I’ve been tasked with building a small camera system for monitoring a pet - and the request specifically asks for it to have zero #cloud services. There’s a mostly-static IP, and web traffic is permitted. I’m planning on putting it behind a self-hosted VPN connection…

What I need help with is decent hardware that has an open source firmware - or hardware that can be flashed with an open source firmware. HD or better (3-8MP?) with support for high quality video (MPEG4?). Bonus Points for POE & Pan/Tilt/Zoom.

This dumb password rule is from HDFC Bank.

Only a maximum of 15 characters and some special characters are not allowed.

https://dumbpasswordrules.com/sites/hdfc-bank/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from NordVPN.

- Password cannot be longer than 48 characters.

https://dumbpasswordrules.com/sites/nordvpn/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from CAF (French Family Allowance Fund).

You have to enter your 8-digit password using this Frenchy keypad.

https://dumbpasswordrules.com/sites/caf-french-family-allowance-fund/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from NVV (Nordhessische VerkehrsVerbund).

Password length must be 4 to 10 characters with only a few special characters allowed.

https://dumbpasswordrules.com/sites/nvv-nordhessische-verkehrsverbund/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Itaú Bank.

I know, it's in spanish, let me translate this monstrosity for you.

- Allowed characters: letters A to Z uppercase or lowercase (ñ is not allowed), number 0 to 9, #, $, %, &, +, -, . :, ;, _.
- You must use 8 characters.
- The password must contain at least one letter and at least one number.
- ...

https://dumbpasswordrules.com/sites/itau-bank/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from E-Redes.

Portuguese power distribution company, which requires short passwords (10 to 15 characters), no repetition of the same character, not using the username, the word "PASS" or the word "SAP" in the password, and limiting which special characters can be used.

https://dumbpasswordrules.com/sites/e-redes/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Intel.

https://dumbpasswordrules.com/sites/intel/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

@GossiTheDog They aren't clueless but when I worked in #InfoSec, they didn't have a good history of sharing intelligence gained with others, in case it damaged brand value.

This dumb password rule is from Zurich.

Password must be EXACTLY 8 characters long.

Alpha numeric characters ONLY.

The first character must be alphabetic.

NO spaces.

The new Password cannot be the same as the last 32 passwords you have used. (they actually store your last 32 passwords)

https://dumbpasswordrules.com/sites/zurich/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Polytechnique Montreal.

Passwords must have a minimum length of 8 characters

Passwords must have a maximum length of 30 characters

Passwords must contain a minimum of 2 digits

Passwords must contain a minimum of 2 letters

Password must be different than the last one used

Passwords may contain these special characte...

https://dumbpasswordrules.com/sites/polytechnique-montreal/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from University of Windsor.

The password policy applies to alumni as well. Must be at least 10
characters long, with at least 1 upper case and 1 lower case
character, at least 1 number, at least 1 special character. Password
expires every 120 days, and you can't reuse an old one.

https://dumbpasswordrules.com/sites/university-of-windsor/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

Hello friends, I've seen the below image come up a few times elsewhere and am going to expound a little!

While the hyperlinks in the image display correctly, those aren't actually the addresses of those sites! Instead, they're the Internationalized Domain Name replacements - examples of what are called IDN Homograph Attacks.

It's incredibly hard to include all characters from all active alphabets in the mechanisms that resolve domain names - so currently that letter set is restricted, and instead uses a translation system called Punycode to move between a visual URL with the correct characters and a domain name your computer can actually resolve to a website.

So while neurovagrant[.]com is fine either way, nӘ̃urovagrant[.]com isn't! The actually domain would be xn--nurovagrant-rkg322d[.]com.

Notice that xn-- ! That's what tells browsers and other software that it's an IDN domain, and to try and translate it.

Attackers use this to their benefit. So:

xn--mcrosoft-security-teams-1ec[.]com can appear in your email, on your twitter feed, in other places visually as: mícrosoft-security-teams[.]com

You may think you're signing in to check your retirement at vanguarɗ[.]com but it's actually sent you to xn--vanguar-4cd[.]com

A link that appears as vḙnmo[.]com actually sends you to the website xn--vnmo-q64a[.]com

They even target kids! Take a look at xn--rblox-jua[.]com - which looks like röblox[.]com in most settings. Note the diacritical mark above the first o.

If anything looks off, there's a reason. Always view links with skepticism, don't click on things unnecessarily, and always sign into the sites you use by going to the domain name you know.

Stay frosty out there, friends.

#cybersecurity #infosec #StayFrosty

Alt...

Screenshot that says "Spot the difference" and shows two different maybank and citibank addresses - one that is legitimate, and one that uses a cyrillic 'a' to send you to an illegitimate site.

This dumb password rule is from Munich Foerdermittel Portal.

You register on their funding portal and receive an email with an activation link to set a password.
The email further informs you about their password policy:
- At least 8, but no more than 20 characters
- At least one lowercase and uppercase letter
- At least two digits (1,2,3,4,5,6,7,8,9,0) or...

https://dumbpasswordrules.com/sites/munich-foerdermittel-portal/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Jaa Lifestyle.

When we try to change password and accidentally gave a wrong password for confirm password.
Lets try to read and figure out what they are trying to point out.

https://dumbpasswordrules.com/sites/jaa-lifestyle/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

It is the year 2026 and I am still finding the one of the fastest ways to get local admin in a Windows environment is to search out the unattended setup XML's, because the passwords are still only base64 encoded.

People don't realize and just leave the files out on open file shares so they are easy to grab.

Thanks, people!

#infosec

This dumb password rule is from Sephora.

Password must be between 6 and 12 characters. No other rules
specified.

https://dumbpasswordrules.com/sites/sephora/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from KPMG Talent Community.

While stating otherwise, the site actually *accepts a backslash* in the password
and displays a forward slash as the example of the disallowed backslash
Password:
- Must be at least 8 characters long
- Must contain at least 1 number
- Must contain at least 1 letter
- Must contain at least 1 spec...

https://dumbpasswordrules.com/sites/kpmg-talent-community/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Sparkasse.

„Sparkasse“ is a group of banks which is pretty popular in Germany. It
calls its passwords „PIN“ („persönliche Identifikations-Nummer“ —
personal identification number), the rules are pretty horrific and its
not even a number, even though it is called as such! Here is a
screenshot from the branch...

https://dumbpasswordrules.com/sites/sparkasse/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Easyjet.

No more than 20 characters, use any symbols you like... Oh except #, &, +, or space of course.

https://dumbpasswordrules.com/sites/easyjet/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from LINE.

Password must:
- be between 8 to 20 characters
- not contain characters that repeat in a row
Password must contain three of the following:
- an upper-case letter
- a lower-case letter
- a number
- a symbol

https://dumbpasswordrules.com/sites/line/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Replit.

Forces to use minimum 8 characters in the password and it must contain at least one uppercase.

https://dumbpasswordrules.com/sites/replit/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

Every single blueteamer in information security at the moment...

#infosec #cybersecurity #security

Alt...

tis picture shows the "this is fine meme", a comic dog sitting in a room on fire saying "this is fine"

This dumb password rule is from SONY.

- between 8 and 30 characters
- at least one number or special character
- not part of email address
- avoid common passwords
- repeating characters 3 or more times should be avoided
- currency characters and 3 or more consecutive characters, also in reverse order, should be avoided
Somehow "$" i...

https://dumbpasswordrules.com/sites/sony/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Mobility.

The username is the customer number, which is sequential and cannot be changed, currently 7 digits long for new customers.
The password has to be exactly 6 digits long, only numbers allowed.

https://dumbpasswordrules.com/sites/mobility/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

New.

Socket: Popular Rust Crates Compromised in Build-Time Supply Chain Attack https://socket.dev/blog/popular-rust-crates-compromised @SocketSecurity #infosec #threatresearch #Rust #supplychain #cyberattack

Oh. My. Bob, you can override #AI guardrails with #encryption. Beautiful.

“Rony Utevsky, a researcher at security firm #Adversa, recently discovered a simple way to completely bypass that restriction. Rather than composing the harmful instruction in plaintext, the hacker encrypts it. The website hosting the ciphertext also includes plaintext instructions for decrypting the encrypted content, along with the decryption key. Using this simple sequence, #Grok then follows the command as soon as the user instructs the assistant to summarize the page. There is no warning, and no confirmation is required.”

https://arstechnica.com/security/2026/08/grok-exfiltrates-user-data-when-malicious-instructions-are-encrypted/

Ahahahahahahahah. Turn them off my dudes, your techbro fantasies are disasters.

#infosec #llm #hacktheplanet

This dumb password rule is from Dnevnik.ru.

Silently (sic!) trim password to 30 symbols.

That causes the stupid case when you could successfully registrate an account with password length of 52 and can't login with the password.

https://dumbpasswordrules.com/sites/dnevnik-ru/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from CWT Business Travel Management Company.

Password:
- 8 to 32 characters long
- Must contain a combination of letters, numbers and symbols
- Must be different from your username
- Must be different from 5 previous passwords

https://dumbpasswordrules.com/sites/cwt-business-travel-management-company/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Jaa Lifestyle.

When we try to change password and accidentally gave a wrong password for confirm password.
Lets try to read and figure out what they are trying to point out.

https://dumbpasswordrules.com/sites/jaa-lifestyle/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Ticketmaster.de.

Your password length is limited between 8 and 32 characters.

https://dumbpasswordrules.com/sites/ticketmaster-de/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Nectar API.

The Nectar website allows strong passwords.
However, when trying to link my Sainsbury's account, I found the API has different ideas...
- Password field length capped to 16 characters

https://dumbpasswordrules.com/sites/nectar-api/

#password #passwords #infosec #cybersecurity #dumbpasswordrules