Everyone knows, and still reuses
Everyone knows not to reuse passwords. They reuse them anyway.
(Illustrative scenario, not a real incident)
At every training session, the instructor says:passwords should be long, and never reused.
Everyone in the room nods.Back at their desks, faced with a new site to sign up for,their fingers still type out the same passwordthey’ve used for years.
At this forty-person travel agency,someone else logged into the booking-system accountof A-Ming in sales.The contact details on a few orders were quietly changed.
The investigation foundthat A-Ming used the same password on several sites,and one of those sites had been breached.
A-Ming was at a loss:“I know I shouldn’t.But there are just too many passwords to remember.”
I used to think people didn’t do itbecause they didn’t know.Later I realizedeveryone knows.It’s just that the safe wayis so much more trouble than the easy way.
And ones like “company name plus the year”are guessed on the first try.
Rather than reminding people again and again,make the right thing a little easier.
Good habits aren’t somewhere far away.They live in every moment you open a login screen.
Provide a company password manager, so “a random long password for every site” becomes the easiest option; for important systems, add two-step verification on top.