Even after the Heartbleed bug, some of the most popular websites aren’t taking password security seriously, according to a study.
More than 80 percent of websites that were examined had subpar password security standards, according to Dashlane’s Password Security Roundup report published Tuesday.
Dashlane, a password management company, examined 80 websites across six categories: dating, e-commerce, travel, productivity, social utilities and security.
Overall, 51 percent did not lock accounts after 10 incorrect password entries, 43 percent accepted the most commonly used passwords such as “password” or “123456” and 86 percent did not meet the requirements to score high enough to be considered adequately safe, Dashlane said.
The way the sites were ranked allowed for them to score between minus 100 to 100. To be considered to have an adequate password policy a website needed a score of 50.
What sites ranked the lowest?
Match.com had the worst password policies, followed by Hulu and Overstock, which both tied for second worst.
Match.com, for example, allowed users to create an account by using only the letter “a” as a password, the study said.
Other sites that scored poorly included Amazon, Groupon, Orbitz, and Victoria’s Secret. CNBC requested comment from these companies via email when this embargoed story was released.
“We have always taken the security of our website and customer’s personal information very seriously, and certainly long before this list was released,” an Orbitz spokeswoman said, via email. “Password security does not necessarily guarantee website security, so we implement a series of industry standard security measures to keep our customer’s information safe.” She noted that customers can use passwords as long as 32 characters.
The site that scored the highest was Apple. The iPhone maker had a perfect score of 100. Hotmail came in second, followed by the Microsoft Store website and UPS.
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behaviour or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
