Weak Password Rules

[mackybham]

Can anybody explain why the password rules are so weak on our Virgin Media accounts and email? 

At the moment the rule is A letter at the beginning maximum of 10 alpha numeric characters lower or upper case. Why are no special characters and longer than 10 alpha numeric passqwords allowed.

Kind Regards

Lee 

[HowardML]

Sure. The systems were an amalgam of lots of different email systems from the companies that merged to form VM. The rules haven't changed since those days and they will remain the same for the foreseeable future. But if you chose carefully and change your VM password from time to time you don't run a high risk of a security issue. You aren't forced to use VM mail. If you want to use a free email service with stronger passwords then there is plenty of choice out there.

[mackybham]

That a poor excuse as VM has had all the providers merge for at least 8 years. 

Like I said the password is not only for email, but also for your managed account for your contract. It seems to VM is too lazy to tighten up their security.

[HowardML]

VM will speak for themselves. I gave you my understanding of the position. Read my signature - I do not work for Virgin Media. Don't attribute motives  to me about what VM does or doesn't do over password security.  But the question you raise arises quite often and Vm always give the same reply. No change for the foreseeable future. 

[mackybham]

Howard i was not directing it at you. I am saying VM are very lazy with security.

If they suddenly have a data breach where customer's Direct Debit details get stolen it will cost VM upto 4% of all revenue in fines. 

[HowardML]

Thank you for that. The last data breach that VM had (and described in the link below) didn't involve the single sign-on system. Of course VM are aware of the risks they may be running with their current single sign on system and security but they need to balance the risk with the commercial consequences incurred by an entire rewrite of the single sign on system.

https://community.virginmedia.com/t5/News/Virgin-Media-s-data-incident-Help-and-Advice/ba-p/4166258

[yakacm]

This seems to come up again and again, there's a question from 6 years ago asking the same thing. 10 characters alpha numeric, when the standard everyone else uses is 16 characters, alpha numeric and special characters. I don't know enough about it to be able to tell how weak VM password rules are, but I know they are a lot weaker than the standards used elsewhere, and for my own peace of mind I'd like to be able to use a password generator to generate a stronger password, that's not to say I don't use a password generator for my VM passwords I'd just like them to be stronger.