This dumb password rule is from Vietnam Airlines.
`[[:alnum:]]{6,8}`
dumbpasswordrules.comVietnam Airlines - Dumb Password Rules`[[:alnum:]]{6,8}`
Recent searches
Search options
#passwords
22 posts15 participants3 posts today
Replied in thread
” Mothers maiden name: 5472615884
First car owned: 3656654851
Favorite color: 2580548933
They get generated and stored in the password manager, for each account as needed.
The advantage of ten digit numbers is that they are easy to communicate to a customer service agent over the phone.
IME, no agent has ever batted an eye. It's not even lying. It's just being clear on the purpose.
Next #swad improvement: Make sure to #wipe #passwords from RAM directly after used. That's more of a #security precaution, because there *should* be no way how an attacker can access a running process' memory, but you never know which bugs surface 
.
Unexpectedly, that posed #portability issues. #C11 has #memset_s ... a pretty weird function, but suitable for wiping. It's there on #FreeBSD and on #OpenBSD. Not on #NetBSD though. But NetBSD offers the much saner #C23 function #memset_explicit. Looking at #Linux, there's neither. But there is the (non-standard!) #explicit_bzero 
.. and with glibc, it requires _DEFAULT_SOURCE to be defined as soon as you compile with a C standard version given to the compiler. This function exists on some other systems as well, but there's confusion whether it should be declared in string.h or strings.h. 
Here's the full set of compile-tests I'm now doing, only to find the best way to really erase memory:
https://github.com/Zirias/swad/blob/master/src/bin/swad/swad.mk#L6
And if none of these functions is found, swad uses the "hacky" way that most likely works as well: Access the normal memset function via a volatile pointer.
GitHubswad/src/bin/swad/swad.mk at master · Zirias/swadSimple Web Authentication Daemon. Contribute to Zirias/swad development by creating an account on GitHub.
This dumb password rule is from Suncorp.
To "improve security" and "be password savvy", passwords must:
- be six to eight characters long
- Contain both numbers and letters
- Include upper and lowercase letters
dumbpasswordrules.comSuncorp - Dumb Password RulesTo "improve security" and "be password savvy", passwords must:
- be six to eight characters long
- Contain both numbers and letters
- Include upper and lowercase letters
Fellow #Security professionals: do you recommend users keep their #TOTP keys in the same #PasswordManager vault as their #passwords (if the password managers support multiple vaults, eg.: #Keepass)?
CVE-2025-24054, NTLM Exploit in the Wild
A critical vulnerability, CVE-2025-24054, related to NTLM hash disclosure via spoofing, has been actively exploited since March 19, 2025. The flaw allows attackers to leak NTLM hashes or user passwords using a maliciously crafted .library-ms file, potentially compromising systems. A campaign targeting government and private institutions in Poland and Romania used malspam to distribute Dropbox links containing archives exploiting this vulnerability. The exploit can be triggered with minimal user interaction, such as right-clicking or navigating to the folder containing the malicious file. This vulnerability appears to be a variant of the previously patched CVE-2024-43451, sharing several similarities.
Pulse ID: 680034fc84efc0751b3bc07d
Pulse Link: https://otx.alienvault.com/pulse/680034fc84efc0751b3bc07d
Pulse Author: AlienVault
Created: 2025-04-16 22:53:48
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
LevelBlue Open Threat ExchangeLevelBlue - Open Threat ExchangeLearn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.
This dumb password rule is from CVent.
Password Rules
- 8 to 20 characters with at least 1 number and 1 letter.
- No symbols or spaces.
dumbpasswordrules.comCVent - Dumb Password RulesPassword Rules
- 8 to 20 characters with at least 1 number and 1 letter.
- No symbols or spaces.
This dumb password rule is from Tangerine.
Your PIN can only contain numbers and must be between 4 and 6 numbers.
dumbpasswordrules.comTangerine - Dumb Password RulesYour PIN can only contain numbers and must be between 4 and 6 numbers.
This dumb password rule is from CAF (French Family Allowance Fund).
You have to enter your 8-digit password using this Frenchy keypad.
https://dumbpasswordrules.com/sites/caf-french-family-allowance-fund/
dumbpasswordrules.comCAF (French Family Allowance Fund) - Dumb Password RulesYou have to enter your 8-digit password using this Frenchy keypad.
Thanks to our #TurrisSentinel #security #research program, #CZNIC #CSIRT team discovered large scale #FTP #attack. Coming from 45.78.4.0/22, it is #bruteforcing #slowly - it takes it 19 day to get through it's #passwords. Big thanks to everybody who helps us by running our #minipots on their devices! Report in #Czech is available on CSIRT website https://csirt.cz/cs/kyberbezpecnost/aktualne-z-bezpecnosti/distribuovany-ftp-bruteforcer/
csirt.czDistribuovaný FTP bruteforcer - Aktuálně z bezpečnosti
- CSIRTAktuálně z bezpečnosti
Replied in thread
@Alrescha @mrtechking IMHO #passwords, #passkeys, and #TOTP authentication are too important to tie to a single vendor’s OS/browser, which is one reason I favor #Bitwarden to manage all three.
#Apple has done amazing work and the UX is nearly seamless, but I have to work outside of their ecosystem as well.
#Apple has done amazing work and the UX is nearly seamless, but I have to work outside of their ecosystem as well.
This dumb password rule is from Ancestry.
Password:
- Must be at least 8 characters long
- Must contain at least 1 number
- Must contain at least 1 letter or special character
- Must not be a well known or common password
dumbpasswordrules.comAncestry - Dumb Password RulesPassword:
- Must be at least 8 characters long
- Must contain at least 1 number
- Must contain at least 1 letter or special character
- Must not be a well known or common password
Yes, this is definitely a great password Jetbrains.
https://www.reddit.com/r/Passwords/comments/1jzepn6/thats_a_great_password/
This dumb password rule is from Coventry Building Society.
Password has to be between 6 and 10 characters, can't contain any punctuation and you have to give characters from it on the phone to confirm identity.
https://dumbpasswordrules.com/sites/coventry-building-society/
dumbpasswordrules.comCoventry Building Society - Dumb Password RulesPassword has to be between 6 and 10 characters, can't contain any punctuation and you have to give characters from it on the phone to confirm identity.
This dumb password rule is from PizzaHut.
Passwords must be greater than 6 characters, and have an arbitrary set of rules we don't tell you about until after you try to set your password.
dumbpasswordrules.comPizzaHut - Dumb Password RulesPasswords must be greater than 6 characters, and have an arbitrary set of rules we don't tell you about until after you try to set your password.
This dumb password rule is from University of Texas at Austin.
Because of the last two rules, which ban dictionary words and any
variants using symbol substitutions, *neither* of the passwords
presented in the [xkcd comic](https://xkcd.com/936/) are allowed.
https://dumbpasswordrules.com/sites/university-of-texas-at-austin/
xkcdPassword Strength
This dumb password rule is from CodePen.
The password should be of at least 8 characters and must include a number, special character, an upper as well as a lowercase letter
dumbpasswordrules.comCodePen - Dumb Password RulesThe password should be of at least 8 characters and must include a number, special character, an upper as well as a lowercase letter
This dumb password rule is from Standard Chartered Bank.
- Between 8 to 16 characters
- Only letters and/or numbers
https://dumbpasswordrules.com/sites/standard-chartered-bank/
dumbpasswordrules.comStandard Chartered Bank - Dumb Password Rules- Between 8 to 16 characters
- Only letters and/or numbers
This dumb password rule is from Rediff.
A maximum password length of 12. The hidden requirements are:
- at least 1 uppercase letter
- at least 1 lowercase letter
- at least 1 numeric character
- at least 1 special symbol (which can not be ^, %)
dumbpasswordrules.comRediff - Dumb Password RulesA maximum password length of 12. The hidden requirements are:
- at least 1 uppercase letter
- at least 1 lowercase letter
- at least 1 numeric character
- at least 1 special symbol (which can not be ^, %)