This dumb password rule is from Southwest.

Password must be between 8 and 16 characters in length and include at least one uppercase letter
and one number. Certain special characters are also allowed, but the first character of the password must be alphanumeric.

https://dumbpasswordrules.com/sites/southwest/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Inria.

This is the account for those who work at [Inria](https://www.inria.fr/)
"the French national research institute for
the digital sciences".

You have to wonder what's wrong with these special characters but not
the other ones.
- Password expiration once a year
- Your password must contain at leas...

https://dumbpasswordrules.com/sites/inria/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Ancestry.

Password:
- Must be at least 8 characters long
- Must contain at least 1 number
- Must contain at least 1 letter or special character
- Must not be a well known or common password

https://dumbpasswordrules.com/sites/ancestry/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

I let Starbucks know one of their internal systems was sending emails to an @internaluser.com address btw.

"Our internal team has reviewed the reported issue and has determined that the security impact of the finding does not meet our threshold for warranting any further action of remediation. We appreciate you for bringing this to our attention."

#infosec

This dumb password rule is from Eufy.

Eufy caps new passwords at 20 characters and restricts special characters to a fixed
allowlist (`!*@#$%^&*()_-|[0]/?.,>`), on top of requiring uppercase, lowercase, and
numbers. A hard upper bound well under any real hashing algorithm's actual limit is a
classic sign of dubious password handling ...

https://dumbpasswordrules.com/sites/eufy/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

🚀 Defguard 2.2 Hardware Key (FIDO2) MFA

🆕 What's new:
- FIDO2 hardware keys as WireGuard® MFA factor
- Multi-step MFA flows per location
- Redesigned mobile client
- MFA setup in the desktop client
- Firewall bulk actions

👉 https://defguard.net/releases/2.2.0/features/

#vpn #sysadmin #devops #selfhosted #SelfHosting #wireguard #OpenSource #release #security #privacy #homeLab #anonymity #floss #docker #CyberSecurity #InfoSec #OnlinePrivacy #DataProtection #InternetSecurity #NetworkSecurity

Alt...

Defguard 2.2 Release - Enterprise VPN on WireGuard with built-in FIDO2 hardware key MFA

Winning infosec conferences by dumping a bunch of smart devices barely in WiFi range and then just taking the stage #InfoSec

This dumb password rule is from NBank.

User ID *has to* contain special characters, password *may not* contain (basically) any special characters.

https://dumbpasswordrules.com/sites/nbank/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Stuttgart Media University.

Your password has to be between 10 and 14 characters.
Also, you need to have at least one number, one uppercase letter and one lowercase letter.
And at least one of these special characters: ```!.,;+-=#$()[]{}&*```.
But don't use any of these special characters: ```<>|§@€?:%^\"'`°~```.
And don't...

https://dumbpasswordrules.com/sites/stuttgart-media-university/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Epic Games.

You must:
- Not use any of your last 5 passwords
- Use at least 7 characters
- Use at least 1 letter
- Use at least 1 number
- Not use spaces

Max password length's 256 characters.

https://dumbpasswordrules.com/sites/epic-games/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Itaú Bank.

I know, it's in spanish, let me translate this monstrosity for you.

- Allowed characters: letters A to Z uppercase or lowercase (ñ is not allowed), number 0 to 9, #, $, %, &, +, -, . :, ;, _.
- You must use 8 characters.
- The password must contain at least one letter and at least one number.
- ...

https://dumbpasswordrules.com/sites/itau-bank/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

RE: https://infosec.exchange/@BleepingComputer/117559733479228807

Between this and those supermarket fridges, it’s apparently retro week in #infosec

BleepingComputer » 🌐 2026-11-04
@BleepingComputer@infosec.exchange

DreamHost is warning of a data breach after attackers gained access to its File Manager platform for two months and stole customers' FTP/SFTP usernames and passwords.

https://www.bleepingcomputer.com/news/security/dreamhost-confirms-data-breach-exposed-ftp-logins-and-webmail-sessions/

This dumb password rule is from Discovery Benefits.

Requires at least one symbol, but must be one of `! @ # $ % & * ?`, and also
has an unstated max length of 20 characters.

https://dumbpasswordrules.com/sites/discovery-benefits/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Air France.

- Between 8 to 12 characters
- Should contain capital, lowercase letters and numbers

https://dumbpasswordrules.com/sites/air-france/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

@briankrebs Yes,🤔mSeven Software has provided no details about what system was targeted, how long the incident lasted, or whether vault data was actually exposed.🤦🏼Users are facing the daunting task of triaging hundreds of records and should assume a worst-case scenario and treat stored data as potentially compromised. #Infosec

If you missed this Google announcement yesterday:

Google: Shutting the Door on the XCPE Botnet https://cloud.google.com/blog/topics/threat-intelligence/shutting-the-door-on-the-xcpe-botnet

More:

KrebsonSecurity: Tech Firms Dismantle Botnet That Turned 1.3M TV Boxes Into Proxies https://krebsonsecurity.com/2026/11/tech-firms-dismantle-botnet-that-turned-1-3m-tv-boxes-into-proxies/ @briankrebs #Google #botnet #infosec #Android #threatintel #threatintelligence

It's 2026.

We've had a public security.txt since 2018: https://www.bbc.co.uk/security.txt

Every week we receive multiple emails from security researchers asking if we have a bug bounty.

Is general awareness really still *that* low?

#InfoSec #BugBounty #WebDev

This dumb password rule is from Aetna Health Insurance.

- Password cannot be longer than 20 characters
- Password cannot have spaces and more 2 characters repeated in a row
- Password cannot have user's first name, last name or username

https://dumbpasswordrules.com/sites/aetna-health-insurance/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

My previous intro post was a few years old, so behold, new intro post:

Mike. Live in the Seattle area having grown up in the UK as a full blown British. Have a wife (incredible), child (boy), and three dogs (golden retriver/cream retriver/fuck knows).

I work in information security, something I have done for about 20 years. By day I run corporate security, enterprise IT and various other bits and pieces for an EV charging startup. I am big into EV's and currently drive one that is not a Tesla. I want an electric motorbike, so if anyone has a spare one please send it.

I also have a company of my own, Secure Being (https://securebeing.com), which does pen testing and digital forensic work - it's my way of staying super hands on while still doing the management bits on the career path.

I have written books about information security things. Five of them. Two are non-fiction textbooks, and three are fiction based on real world #infosec things. Check out https://infosecdiaries.com and your local bookstore to find them, just search for my name. I have been trying to write more stuff, but always seem to find myself distracted by other things, such as work. linktr.ee/secureowl has some mini stories I've written.

I love radio and everything RF. I have lots of antennas and various scanners and radios on my desk. I love intercepting and decoding things, like digital radio protocols.

I am a big aviation nerd. I always wanted to be a commercial pilot. I gained my private pilots license in the UK at 17, all self funded by my employment at the local Safeway/Morrisons store. I did the sim test and commercial assessments, but for some reason, at 18, I was unable to find the £100k needed to complete the commercial training, so I did computers. But do not worry, because those computers and love of aviation and radio/RF combined, and I run a project called ACARS Drama. https://acarsdrama.com has all the details.

I play guitar and am a big guitar/audio nerd as well. I record music under the moniker Operation: Anxiety, https://operationanxiety.com - the music is on all the normal places.

Finally, I am a massive fan of motorsport. I believe I have watched every F1 race for the last 30 years, maybe 25. I also follow F2, FE, Indycar and MotoGP closely. I average around 18 hours of Le Mans 24 hour racing watching per year.

So there you have it. If you are looking for a thought leader on the topics mentioned above, you've come to the wrong place - because this is where I shitpost, and shitposting is cheap therapy.

#infosec #dfir #pentesting #acars #vdlm2 #sdr #rf #f1 #seattle #introduction

This dumb password rule is from BDO.

Please nominate a password which contains UPPERCASE, lowercase, numbers and symbols.
Password should not be the same as the user ID.
Avoid using consecutive characters such (ex. abc, DEF, 678) and invalid characters such as [!#$%^&';"].

https://dumbpasswordrules.com/sites/bdo/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

"similar to hack of French stores"

Another cracking month of Infosec awareness ahead of us then...

https://www.theguardian.com/world/2026/nov/02/supermarket-freezers-across-europe-hit-by-second-suspected-cyber-attack

#Infosec #Retail #EUPol

@GossiTheDog Funnily enough, the media are still reporting it as a cyberattack, even though access is wide open to any script kiddie.

#infosec #OTsecurity #IoT #supermarkets

This dumb password rule is from Best Buy.

You can enter whatever password you like! But you probably don't want to
make it too long, because you'll break us and you'll never be able to
login again.

https://dumbpasswordrules.com/sites/best-buy/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Slovenska sporitelna.

Slovenska sporitelna is the biggest bank in Slovakia. Despite pretty new version of the internet banking (rolled out in 2018), their password policy restricts password to be 16 characters long at most and prohibits any special characters.

https://dumbpasswordrules.com/sites/slovenska-sporitelna/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Red Hat.

Symbols. You keep using that word. I don't think it means what you think
it means.

https://dumbpasswordrules.com/sites/red-hat/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from AirAsia.

- Between 8 and 16 characters
- Must contain a number, a lowercase letter, and an uppercase letter
- Special characters allowed, but not periods, commas, tildes, or angle brackets

https://dumbpasswordrules.com/sites/airasia/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Air Miles.

- Exactly 4 numbers.

https://dumbpasswordrules.com/sites/air-miles/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Apple.

Can't contain 3 or more consecutive identical characters, nor can it be more than 63 characters long.

https://dumbpasswordrules.com/sites/apple/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

New.

Socket: Cursor Removes Malicious Claude Code 2.1.313 Extension From Its Marketplace https://socket.dev/blog/claude-code-extension-compromise @SocketSecurity #infosec #Anthropic #Claude #Cursor #threatresearch

This dumb password rule is from Banco Nacional (Costa Rica National Bank).

Between 8 and 16 characters.

Must have 4 numbers and 4 letters.

Must not contain same letter or number in consecutive order.

Can't contain vowel letters neither the letter Ñ.

Password can't be the same as the previous 6 used.

https://dumbpasswordrules.com/sites/banco-nacional-costa-rica-national-bank/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

The more I think about it, the more this makes me angry.

I have had jobs with leadership who treat people like this. It damages your health (mental, physical, and emotional).

And in a market like ours, I suspect there are a lot of people at Proton who have pits in their stomachs. They’re expressing their pain to their partners, or kids, or friends. Feeling trapped.

This is what emotional abuse, toxic masculinity, and tech-bro capitalism look like. I’m tired of people thinking ethics and technology aren’t intersectional. They are.

Fuck Andy Yen, and fuck @protonprivacy.

🧵 2/2

#Proton #AndyYen #Tech #Privacy #InfoSec #AI

Alt...

Quote from Andy Yen that reads: “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure. Stop thinking always of how to be slower, and focus more on how to be faster. Only losers think like that. Stop lovingly handcrafting all our code and use AI more.” It cites the source as 404media.co/manifestos-fear-and-loser-thinking-inside-protons-ai-reckoning.

RE: https://mas.to/@markwyner/116184563372403595

Imagine trusting your privacy with a company who favors speed over integrity.

A @protonprivacy employee cautioned against releasing new code that wasn’t properly tested. Andy Yen responded to all Proton employees:

“That’s bullshit and loser thinking. Of course it’s possible to be fast and secure. Stop thinking always of how to be slower, and focus more on how to be faster. Only losers think like that. Stop lovingly handcrafting all our code and use AI more.”

Some of us keep warning folks to avoid Proton. Unfortunately, others, like trusted source @privacyguides, ignore the red flags and recommend it anyway. If you use Proton, you’re at risk.

https://www.404media.co/manifestos-fear-and-loser-thinking-inside-protons-ai-reckoning

🧵 1/2

#Proton #Privacy #InfoSec #AndyYen #AI

This dumb password rule is from Aetna Health Insurance.

- Password cannot be longer than 20 characters
- Password cannot have spaces and more 2 characters repeated in a row
- Password cannot have user's first name, last name or username

https://dumbpasswordrules.com/sites/aetna-health-insurance/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

New. PLEASE, don't. Click. On. Ads.

"319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing."

"Yahoo and Microsoft operate search syndication programs where partners who bring search traffic get a revenue share on the resulting ads. The partner bringing the searches is assigned tracking IDs. For Yahoo it is the hspart=/hsimp= parameters. In Bing it is the PC= partner code and PTAG= partner tag sub-ID."

Socket: Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users https://socket.dev/blog/searchjacked @SocketSecurity #infosec #Yahoo #Microsoft #threatresearch

This dumb password rule is from SecureAccess Washington.

Central authentication for all Washington State services
(DoL, ESD, etc).

Password must have *exactly* 10 characters, but form happily
lets you enter more and only throws errors after submit,
providing no useful feedback.

https://dumbpasswordrules.com/sites/secureaccess-washington/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This is a “What do you think of this #infosec practice, and what do you think I should do about it?” thread. Please boost!

Executive summary: When an ISP forwards an abuse report to its customer to do something about, is it OK to include the host name and IP address of the server that was attacked and other sensitive details from the abuse report? If not, is it worth complaining and trying to get a huge ISP to do something about it?
1/9

🔥🔥🔥🔥🔥🔥🔥🔥🔥

» Massive Leak Exposes 41,000 Homeland Security Workers—Including Undercover ICE Agents | WIRED
https://www.wired.com/story/massive-leak-exposes-41000-homeland-security-workers-including-undercover-ice-agents/

#infosec #ICE #LOL

Some Plexfiltration Updates:

1) HR department from a Spanish Company sent me an email (with high importance) reminding employees of how seriously they take Halloween, and people wishing to enter the costume contest this year should review last years entries to see the standards - followed by a dozen photos of employees in costumes (I included a non-identifiable one). Sent to internaluser.com.

2) I was able to get ahold of the SaaS Vendor security team whose product was sending me AI meeting summaries and financial KPI's from one of their clients (including 1x1's/and leadership team meetings) on Monday, they thanked me for the heads up - yet, two days later....I am still getting said AI meeting summaries to deleteduser.com.

3) What turns out to a massive department store chain in the Philippines is using deleted-user.com for their soft deletes. Got a bunch of mail from them over the past few days.

4) A software developer at a Fortune 500, and one of the worlds most highly recognizable brands just started using internaluser.com as a test account apparently, and now I'm getting dozens of emails containing reports from an internal system about suppliers.

#infosec

Alt...

A person in a scary halloween costume/mask

This dumb password rule is from Whitcoulls.

Your password must:
- be between 7 and 15 characters
- contain a capital letter
- have no spaces (shown only when you go to change it)

https://dumbpasswordrules.com/sites/whitcoulls/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Telekom.

At first glance, their policy looks good - sure, the upper limit was chosen without necessity
and they enforce characters from all four groups, but your password manager will most likely come up with something suitable.

The website even tells you how 'wunderbar' your new password is - only to t...

https://dumbpasswordrules.com/sites/telekom/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Microsoft (e company store).

Max of 16 character oh and please don't use any characters we don'y know how to escape properly
also if it starts with ? you may break our wonderful website. What out with your password generator
duplicated characters is far too insecure to allow here.

https://dumbpasswordrules.com/sites/microsoft-e-company-store/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from Daybreak Games.

Max password length is 15 characters

The only special characters that can be used are !"#$%

https://dumbpasswordrules.com/sites/daybreak-games/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

This dumb password rule is from FCC.

The password cannot exceed 15 characters in length. The FCC regulates the
internet but apparently didn't get the memo on password security.

https://dumbpasswordrules.com/sites/fcc/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

TFW when your password manager updates with ‘old password’ rather than the one it just suggested and changed for ’new password’. Yes, I know this is my fault for not taking enough care, and it’s *only* my router that I’m now locked out of 😬🙄🤦‍♂️
If I reset the router it should reset the admin password to the original password printed on the back, right? 🤞
#infosec #luddite

This dumb password rule is from Sears.

"cAsE sensitive, no spaces, ! or ?
8 characters min - 1 letter, 1 number
Can't repeat same character more than 3 times in a row
Cannot be or contain your username or email address"

https://dumbpasswordrules.com/sites/sears/

#password #passwords #infosec #cybersecurity #dumbpasswordrules

Am Wochenende wollte ich mir Solidcraft anschauen. Chrome verhinderte den Download der Binary mit einer Malware-Warnung, Safari lässt es gar nicht zu, dass man die offizielle Website des Projekts betritt; ein knallrotes Browser-Fenster warnt unmissverständlich vor einer »Malware-Website«. Das hab ich zuvor noch nie erlebt. Was ist denn bei denen los? Aus gegebenem Anlass keine Verlinkung auf solidcraft dot io.

#CAD #3DDruck #Malware #Infosec

“Pretty intense week with that response to PHP2Shell, am I right?” Said the young SOC analyst to her co-worker at the bar.

“You can say that again, that was crazy?” Came the reply. “Cheers for a job well done!”

Their glasses clinked together and they took their respective sips of beer.

Just then a dark, grizzled figure at the end of the bar came into focus.

“Heh, you kids don’t know what the hell your talking about,” said the figure, interrupting the jovial atmosphere.

“What’s it to you, old man?” The SOC analyst retorted. “You probably have no idea how big of a deal this could’ve been!”

The figure sighed, took a swig of whiskey, and lit a cigarette. He took a drag, and exhaled before continuing to address them.

“You know, there was a year, you were probably still in diapers, 2014, when we had to deal with Shellshock and Heartbleed. Those were real vulnerabilities. We had to fix them while exploitation was happening all around us. Back in those days, they wouldn’t just let us bring down prod to patch either, we had to force that shit down.”

“Yeah, but I mean, PHP2Shell could’ve been the same too - and for us, it’s gonna be more of a thing because AI is finding all these vulns,” the SOC analyst replied.

“Ha. You think AI is a worse adversary than bug hunters with nothing but endless time and cynicism on their hands? Get real. Our bugs were being exploited all around us, and we had real proof of concept code in the hands of anyone - not a fucking essay about potential exploitation in a perfect lab setting.”

“Well, I get it, but I’m sure you were celebrated too, when all was said and done.”

“Ha. We got no parade. We just got Poodle, Meltdown, Spectre, Drown, EternalBlue, Log4Shell. Shit was unrelenting. No AI needed.”

Although they had been skeptical at first, the youngsters were starting to warm to the old timer.

“Are all those vulnerabilities the reason you still sit in this bar drinking and smoking?” Asked the female analyst.

“Not at all,” came the reply. “I just heard about the number 4 thing and that set me off.”

“Ah yeah makes sense. Cheers!”

The three of them raised their glasses.

#infosec