Password storage firm Dashlane Inc. today published a new report that confirms something that many already suspected: Many major companies are terrible when it comes to password security.

The Password Power Rankings survey saw researchers at the company examine the password policies of 40 popular consumer and enterprise websites against five criteria and found that 46 percent of consumer sites and 36 percent of enterprise sites failed to implement even the most basic password security requirements.

Sites were tested on five criteria: Does the site mandate a password longer than eight characters; does the site insist on complexity and prevent users from using passwords such as “aaaaaa” or “111111”; does the site tell users how strong or weak their password is; does the site use two factor authentication; and finally, does the site have brute force protection?

Companies that failed overall include DocuSign Inc. and, remarkably, Amazon Web Services Inc. To be fair, those two didn’t score a perfect zero on security, with that honor going to Netflix Inc., Pandora Media Inc., Spotify Inc. and Uber Technologies Inc.

Of the five criteria, the most obvious and easy one to implement would be protection against passwords such as “aaaaaa.” However, companies and services that allow users to use insecure passwords such as these include Amazon.com Inc., Google Inc., Instagram, LinkedIn, Dropbox and Venmo.

Not every company tested failed. GoDaddy Inc. was the only consumer site to score five out of five, while on the enterprise side Stripe Inc. and QuickBooks were the only two also meeting all five tested criteria.

“We created the Password Power Rankings to make everyone aware that many sites they regularly use do not have policies in place to enforce secure password measures,” Dashlane Chief Executive Officer Emmanuel Schalit said in a statement. “It’s our job as users to be especially vigilant about our cybersecurity, and that starts with having strong and unique passwords for every account. However, companies are responsible for their users, and should guide them toward better password practices.”

Image: Dashlane