The company notes that the most popular sites provide “the least guidance” when it comes to secure password policies. Two-factor authentication: “A site was given credit if they offer any two-factor or multi-factor authentication,” including via SMS or keystick.If the tester was able to continue entering incorrect credentials after 10 attempts” without locking the account, having to fill out a CAPTCHA code or meeting some other security test, “the site did not receive credit.” Brute force attack protection: “Researchers attempted to login using incorrect passwords.If the site provided any notification, such as a meter or color-coded bar, they were credited as providing an assessment,” but not those which merely confirmed the password was of sufficient length or otherwise met minimum criteria. Password strength assessment for users: “Tested by creating a new account on each website.Researchers attempted to create passwords with all letters (aaaaa) or numbers (111111).” Requires letters and numbers: “Tested by creating a new account on each website.Dashlane researchers attempted to create passwords less than 8 characters irrespective of the sites’ stated minimum password requirements.” Eight-plus character minimum length: “Tested by creating a new account on each website.

The five measures the researchers investigated by creating new accounts are: On the enterprise side, two of the 11 companies researched - Stripe and QuickBooks - got five out of five. Basecamp and Salesforce scored four, GitHub and MailChimp three, while Amazon Web Services scored one. Netflix, Pandora, Spotify and Uber all got zero, because they implemented none. Of the consumer sites, only one, GoDaddy, implemented all five of the basic security measures. Additionally, “researchers created passwords using nothing but the lowercase letter ‘a’ on Amazon, Google, Instagram, LinkedIn, Venmo and Dropbox, among others,” according to Dashlane. More than half of all the consumer sites researchers tested allowed a password with fewer than eight characters. The study, produced by password manager company Dashlane, checked the practices of 37 consumer-facing websites and apps for five basic password security measures - including whether new customers could create an account protected by a password using only a repeated single character. Many major internet businesses catering to consumers and companies - including Dropbox, Amazon and Google - allow users to create passwords that consist of strings of a single character that are crackable in seconds, according to new research.

Sign in dropbox using gmail