It seems that every week we have some sort of data breach that results in emails and passwords for users being released. That alone is a good reason why you should not have passwords shared across sites or systems. I can't stress this enough, and if you do this, please go get a password manager today and stop. Really, I mean it.

However is it just the users that create poor passwords? In many cases, sure. However as the people that develop software, we can help. In fact, we should. Security should be on the mind of everyone that writes software.

I ran across a piece on The Hacker News that says far too many sites don't require users to choose strong passwords. I think this is changing, but far, far too many sites don't check a user's password for strength, or reuse. Some even force users to choose less than ideal passwords. I've run into plenty of sites that don't accept the characters in my strong passwords for some reason. Often the length or addition of any special characters if prohibited.

I've said it before, but I'll note it here. Most of us aren't competent at writing authentication routines and should just use one that's already written and been vetted. More importantly, we should be sure the code, application and database, is modular enough and can be replaced if we find that our application needs stronger security. Because it will. We are constantly racing Moore's law to implement better security.