The article focuses on password requirements that websites implement, not user behaviors. Common bad practices mentioned:

• Permit very short passwords
• Do not block common passwords
• Use outdated requirements like complex characters

I am tired of websites imposing limitations on passwords, but not sharing what those are. I use a password generator, and rarely know if Unicode characters are allowed, if there’s a limit on the number of characters, etc.

I’ve come across websites where dashes “-” are forbidden. My banking website only allows a maximum of 16 characters. Sometimes there’s a note below the password box, sometimes they don’t tell you until your password fails, and sometimes they don’t ever tell you. If I don’t know what the restrictions are, I’ll end up throwing a cheap password at it until I can find out what’s acceptable.

Something something hunter2 ha ha ha it are funy

Largest study ever confirms something everyone has always known