As Microsoft pats itself on the back for its crackdown on easily cracked passwords, keep this in mind: a quick check shows users still have plenty of leeway to make poor choices. Like "Pa$$w0rd" (excluding the quotation marks).

As a Microsoft program manager announced earlier this week, the Microsoft Account Service used to log in to properties such as Xbox Live and OneDrive Azure has been dynamically banning commonly used passwords during the account-creation or password-change processes. Try choosing "12345678," "password," or "letmein"—as millions of people regularly do—and you'll get a prompt telling you to try again. Microsoft is in the process of adding this feature to the Azure Active Directory so enterprise customers using the service can easily stop employees from taking security shortcuts, as well.

But a quick check finds it's not hard to get around the ban. To wit: "Pa$$w0rd1" worked just fine. And in fairness to Microsoft, Google permitted the same hopelessly weak choice.

Saving users from themselves

This shouldn't be taken as a criticism of Microsoft or Google. Blacklisting weak passwords at the platform level is probably one of the most effective measures service providers can take to improve passcode strength. But the measure is most likely intended to thwart only so-called online password cracking. That's when attackers try to guess a password when logging in to a specific account on a specific service. Guccifer—the nom-de-hack for a Romanian man now under US indictment, used online cracking to gain unauthorized access to e-mail accounts belonging to family members of two former US presidents, a former US cabinet member, a former member of the US joint chiefs of staff, and a former presidential advisor. His intrusions didn't require technical skill, just patience and luck.

Blacklisting is likely to statistically lower the success of online cracking, and it's certainly better than requiring password changes every three months, as a shockingly large number of organizations continue to do. Still, the acceptance of "Pa$$w0rd" by Google and Microsoft just goes to show that blacklisting has its limits, and there's only so much service providers can do to save users from their own poor habits.

In the event of a server breach that allows an attacker to perform an off-line attack—as was the case with last week's list of more than 164 million login credentials belonging to LinkedIn users (the number has been increased from the previous estimate of 117 million)—"Pa$$w0rd" would be among the first to be cracked. With literally hundreds of millions of equally weak passwords in the public domain, banning all of them would prove to be too onerous. A move like that would quickly come to resemble the vexing CAPTCHAs that all too often are impossible to solve on the first few tries.

Of course, there's a more effective measure: any account that stores even moderately sensitive information should be protected by a password that's randomly generated, contains numbers, symbols, and upper- and lower-case letters, is at least nine characters in length, and is unique for each account. This is the most effective protection, but the work it requires on the part of end users isn't likely to make it widely adopted. The policies of Microsoft and Google seem to tacitly concede this.

So let's give credit where it's due. Banning hopelessly weak passwords is a great move that's long overdue. But it is by no means a panacea. Contrary to much of the coverage over the past few days, users still have plenty of room to pick stupid passwords.