Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Different websites have different password requirements

  • Some are content with a combination of just lower case words
  • Some require a combination of lower case and upper case words
  • Some require numbers in your password
  • Some require special charecters

Now I have a number of different passwords modified to suit the website requirements but I often get mixed up about whether the password was

word@%(some numbers) or just word(some numbers)

and I end up often resetting my password or not even logging in.

Now my question is would be wrong or bad design to display the password guidelines next to the login screen ? I understand it might actually make it unsafe to an extent since it also gives guidelines to someone with malicious intent about how a password might be structured but is this a case where security trumps usability or what is the equitable balance between the two.

Edit: Please note that I am talking about the scenario of password guidelines being displayed when a person is trying to log in (having established an account) and not when he is trying to sign up ( I strongly believe password guidelines are very important then)

share|improve this question
    
I think this could be a very good idea, Showing it after a failed login attempt makes good sense, sort of like how Facebook's mobile site unhides your password entry field if you fail to login successfully –  Ben Brocka Jan 19 '12 at 23:24
5  
Attackers love it when websites place arbitrary restrictions on user passwords. It gives them the info they need to tune their attack parameters. –  user9492 Sep 4 '12 at 21:36
    
A hacker would simply create an account to figure out the restrictions wouldn't they? I doubt publishing them help hackers very much. This wouldn't be a very secure password anyway would it? It sounds like you are using the same password for every site or a slight variation. Passwords should be required to be decently long, have different characters/symbols and encourage them to use very hard to guess variations. Everything else is hackable if your system doesn't have a lock out or if the table is stolen somehow. –  Mark Sloan Feb 14 at 18:36

5 Answers 5

up vote 13 down vote accepted

I think it's a great idea!

On numerous occasions I have forgotten a password, and made as if I wanted to create a new account in order to see the password guidance and determine what rules I might have used in order to create my password in the first place. (Yes, I'm aware of various options to manage my passwords.)

Sometimes that even involves having to use another browser on which I've never logged in before. (Stack Exchange is especially annoying because a proper log out actually logs you out on all devices, not just the current browser. I don't want to log out unless I'm sure I can remember my password.)

So here's an example from UPS of where it would be useful; you get a great big list of password restrictions when you create an account:

enter image description here

When you log in later, all you get is this below (you already entered the username on a separate screen!). There's loads of space and it would be so easy to use the same password hints on the login screen. The log-in screen is available from the home page so it's not like this is hard-to-find information, and anyone doing any real jiggery-hackery will be well aware of the restrictions anyway — they're not daft, not by a long shot.

enter image description here

So, yup: go for it. Great idea!

share|improve this answer
3  
The funny part is that restricting password formats in the first place actually makes certain kinds of "jiggery-jaggery" easier. –  Wesley Murch Jan 19 '12 at 20:29
    
@Madmartigan absolutely - although I suppose it's a matter of trade off against passwords that are too easy which I guess is the key issue. I wonder though, whether the average shift is for generally better or worse security as a result of password restrictions. –  Roger Attrill Jan 19 '12 at 20:37
    
"I don't want to log out unless I'm sure I can remember my password." Why? I don't even try, I just save my password via clipboard somewhere (either a file or a password manager, according to its importance). –  maaartinus Sep 26 '12 at 23:15

Different people have different ways of remembering things, so what may work for you may not work for another person. There is no one correct way to build a password.

Password-breaking software use brute force, dictionaries and oft-used password combinations to break a password, hence the necessity of recommending some good practices when creating a password. But giving a detailed instruction on how to build a password, and then reminding this instruction upon failing to write the right password, will be unsafe: ill-intended people can use the instructions provided to build a specific program that will have better chances to break passwords.

It is better to give broad recommendations on how to build a good password. In fact, the Password Strenght Meter is a known design pattern, that normally complements the instructions you mentioned on how to buid a good password.

password strenght meter

share|improve this answer
2  
I am afraid you didnt understand my question ,it wasnt about telling people how they should structure their passwords while signing up for an account it,it was a reminder about how their passwords might be when they try to login i.e. they are reminded about the website's policies of how the login password should be –  Mervin Johnsingh Jan 19 '12 at 18:46
    
@MFrank2012 sorry, my bad. I will add to the answer. –  Naoise Golden Jan 19 '12 at 18:52
    
The problem with password strength meters is that they inherently cannot work, because the strength of a password depends on how it is generated, not on what it is. They might give the user a fuzzy feeling of security, but they're bad at guiding users, typically guiding them towards longer passwords with special characters (and, incidentally harder to type) but not towards more secure passwords (as in, passwords that are harder to crack). Providing guidance on password choice can actually help users; password strength meters can only pretend to do so. –  Gilles Aug 28 at 14:51

I solved a similar login / password problem based on info that I was receiving from operators in our customer service department. Prior to my arrival, the login screen only had user/password/token password fields and submit button, not one word on how to prompt users to remembering their logins. A large chuck of CS calls were reduced by simply adding footnote copy reminding users that passwords included characters, plus atleast 2 numbers and a special character.

User: [Text field] example: Johndow (username field is not case sensitive) Password: [Text field] Reminder: Passwords contain 8 - 16 characters plus 2 numbers and 1 special character.

We also tested the [checkbox] reveal my password, which showed a user what they typed for verification. This also reduced password concerns. I'd post my wireframe, but can't do to low answers. Which as a user would have been nice to know ... prior to trying to post (just sayin ....)

share|improve this answer
    
Agreed; I don't think there's anything wrong with a simple reminder line about passwords, as above. I'm trying to think of some examples where I've seen it recently (I know I have) but am coming up short. –  jcmeloni Jan 19 '12 at 19:31

From a Security perspective – No. From a User Experience perspective – Yes. That’s often the problem when different goals meet in the middle, which one is most important. As this is the site of User Experience, the popular answer is to show users what the rules are. That is fine as long as your security requirements are met.

The potential security issue, when you make password rules public, is that you narrow down the options for hackers, who can fine-tune their algorithms by only testing valid password strings. However, this can be compensated by using longer passwords/pass phrases.

Passwords don’t have to be UPPER CASE, $ym8ols or numbers. Passwords can be strong if they are long enough. In addition, both of your goals have been met making the accounts secure and useful.

enter image description here

share|improve this answer
    
I agree with the relativist part in your answer, although I don't think the security part is something to consider, if somebody is going to attack you, they are going to try enough methods, plus they can always go to your register page and check the requirements; I would go there first just for the fact that in that page the information is always present. Of course, when I say that the security is not something to consider, I don't mean the whole security, I just mean the aspect discussed here. –  PatomaS Feb 14 at 14:38
1  
+1 for the simplicity of long passwords. When I need secure passwords I always use 21+ characters typically a sentence I can remember. They are virtually impossible to crack. Length should be the only real consideration. –  Code Maverick Feb 14 at 15:43
    
@CodeMaverick that's true. We are somehow stuck in the legacy of old school security. Let's change that for the good of our users and their experience! –  Benny Skogberg MCSA Feb 14 at 17:43
    
Is the security issue actually a problem? If I wanted to figure out the rules to hack, it's just a matter of setting up a new account instead of getting it from the login page. I understand that that's one more step for an often automated process, but it seems like a straw man argument. The only way the security threat is real is if your account creation page is not public. –  Perchik Apr 16 at 15:48

I would avoid it; it might work for now, but things might change. There are two issues with that:

  1. Changing guidelines. If your guidelines change (e.g. to become stricter in future), do you print the new guidelines or the original ones? If you print the new ones, you're no longer helping the user remember the password they chose. But if you print the old ones, that leads on to the second problem:
  2. Changing security setup. Your old guidelines might get out of date. Even if they're currently in line with good security practice, things change; in a few years time, security good practice might have changed so that your guidelines show your site to have what has become an outdated and insecure security model.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.