NSA’s own website won’t accept passwords longer than 12 characters

Want a job at the NSA?

Be aware that they don’t like it if your password is longer than 12 characters:

Okay, so this is just the careers portal part of the NSA’s website. It doesn’t mean that everything at the NSA is protected by a password of 12 or less characters. But it’s not exactly the finest example to set for others, is it?

I checked it out for myself, and had to raise an eyebrow at the following pop-up message that the NSA’s website displayed:

It’s good to see that the NSA are using HTTPS/SSL to protect our private information in transit. Oh, wait… hang on a minute…

As Martijn Grooten points out, this “may be a rare case in which there’s really no one but you and the site who sees your traffic.”

A cynic might suggest, of course, that all the NSA are doing is encouraging people to use shorter, weaker passwords for perfectly understandable reasons.

Hat-tip: @tdhopper

Found this article interesting? Follow Graham Cluley on Twitter, Mastodon, or Threads to read more of the exclusive content we post.

Graham Cluley •   @gcluley

Graham Cluley is an award-winning keynote speaker who has given presentations around the world about cybersecurity, hackers, and online privacy. A veteran of the computer security industry since the early 1990s, he wrote the first ever version of Dr Solomon's Anti-Virus Toolkit for Windows, makes regular media appearances, and is the co-host of the popular "Smashing Security" podcast. Follow him on Twitter, Mastodon, Threads, Bluesky, or drop him an email.