Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

Some systems have complex password requirements. Because of this, it may be difficult to remember the password with a particular system. I understand that there may be security reasons for wanting to hide the requirements, but since that information is already available if the user registers, why not make it available on the log-in screen?

Is there any research that indicates it is detrimental to the user experience to provide the password requirements at the log-in screen? Why is this practice not implemented regularly?

I am not suggesting that the requirements always be displayed, but perhaps it may make sense to provide the requirements after a failed log-in, especially if the attempted password doesn't meet the requirements!

For those who want background:

My friend has a website she accesses once a month at most. The password requirements there are strictest I have seen. Every time she uses the site, she inevitably locks herself out and must reset her password. In general, the passwords she attempts do not fit the password restriction rules.

share|improve this question
    
Erm, that links to this question? –  Koen Lageveen May 21 '13 at 17:31
    
@KoenLageveen Lol Oops, here's the correct link to the Related Question: Would it be bad design to put password guidelines next to a login box? –  Daniel Cook May 21 '13 at 17:33
2  
In what sense does the linked question not answer your question? It's selected answer is helpful enough. If you're looking for why nobody does that, I'd say it's because services with draconian password rules obviously don't care about UX, don't care about people actually using the service, but do care about security (but are going about it wrong). –  Koen Lageveen May 21 '13 at 17:39
    
Obligatory link whenever someone thinks they are improving security by imposing all sorts of rules on password composition: Password strength –  Marjan Venema May 21 '13 at 19:22

2 Answers 2

I totally agree that if you are not a frequent user of the site, then it's likely that the user forgets the password. Encouraging password security is not something everyone does so users get used to this simple passwords (or one simple unique password across all of their accounts).

Time has changed but not all sites have realized the importance of this and that causes that users get used to this low level secure passwords.

The best practice for users is to have a password management program or have a standard password that fulfills the requirements of secure passwords (length, uppercase, number, etc). However, you are right, most users don't have this program (or probably don't even know about it).

The solution to show an alert once the user has failed to put in the password is good(either next to the form or as a js alert) saying "please remember that you need x letters, number,etc)' - Some could say that this could lower the security of the site by giving away hints but some others would say that the password "formula" is in the registration form and is no secret.

share|improve this answer

Some softwares with very strong security work like this : 1 you enter your email and some informations about you, the first time 2 an administrator checks your identity and validate it 3 you receive an email with a link to confirm your identity

Since here nothing really different from almost website

But after, the next follow times : 1 you go to the login page 2 you enter your email 3 the system generate a password like an OTP (On Time Password) 4 the system sends you the code by mail 5 you enter the code and your email on the login page.

Some time it sends it not by email but by sms.

I recognise it is strong and strict but I think it is better for the user, he hasn't to remember the password when he uses the system rarely.

I use a system like this rarely and i don't ask myself to remember the password.

The problem of such a way, it is when you use the system everyday, you have to get the password in your mail.

Perhaps in this case you can offer the two options at the first connection : "personal password for frequently connections" or "new password each connection" for rarely connections and the possibility to change it after.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.