Moniker just reset your password, and you need to do something regarding it NOW

Moniker tries to improve security, but…

Moniker just sent an email to all of its clients notifying them that their passwords were reset in the name of better security.

Requiring stronger passwords at Moniker is a good idea. It has historically had weak password requirements, counting password character composition and reset requirements.

Yet the way Moniker made the change was probably counterproductive to security.

The email to each client included the login username and fresh password in plain text.

Which means you ought to definitely take Moniker’s advice to “Please reset your passwords to one of your own choosing that meets the fresh password requirements at your earliest convenience.”

Earliest convenience ought to be “five minutes ago”!

The email is also addressed to “Dear Valued Client” rather than the client’s name. This is a security no-no since it trains clients to think that official communications won’t be addressed directly to them, making it easier for phishers to exploit clients in the future.

The email does include an account number. But I doubt many people know their account number off the top of their head. In fact, I’ve always used a username (not account number) to log in, and it appears this username no longer works!

At least there’s some good news from Moniker on the security front: two-factor authentication is coming soon.