Post

This blew my mind: cphpost.dk/2026-10-10/n... Not sure who needs to know this, but 123456 is not a secure password.

I once worked on a large system with millions of users, an oversight meant that clear text passwords were being output in the log files. Astonishing how many were `123456` or `password` or `hello`, or any number of other easily guessable alternatives.

Doesn't surprise me at all, unfortunately. I imagine the rise of in-browser password managers has helped, but most folks want to get right through the login screen and do their jobs. Understandably.

And so many accounts are low-consequence. What's the issue if someone hacks my Goodreads account for example? If there's a "login with Google" option, just use that. It's the best advice IMHO.