Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

For a secure application, we push users to use passphrases instead of passwords. We've got some explanations in the password change page. For the field, we use the label "passphrase" to push again the user to use some.

One user wondered if people will get confused about what the “passphrase” might be.

Are those concerns real, should we really switch back to "password", or is "passphrase" a better option to help people change their habits?

EDIT: Maybe I've not been clear enough in my question. The question is about the labeling. We will use passphrases and OWASP rules in any cases. The question is "do we display 'password' for the field, or 'passphrase'?". Or "Will the user be confused to read 'username/passphrase' instead of 'username/password' on the login page?"

share|improve this question
1  
Do you have any formatting requirements to enforce a passphrase, or are you just trying to encourage it's use? –  James Jenkins Jun 18 '13 at 9:54
1  
Requirements are minimum 10 characters and at least 3 of the following rules: 1) at least one lowercase char 2) at least one upercase char 3) at least one number 4) at least one symbol (space is concidered as symbol) (It's OWASP recommandations) –  cporte Jun 18 '13 at 10:04
1  
Use "passphrase". Add a nice little blurb to the right on why they would want the security that passphrases provide, and other security tips. Ask xkcd's permission to display the "correct horse battery staple" cartoon, but disallow this passphrase. –  Deer Hunter Jun 19 '13 at 6:45
    
Good idea! Could you put this as an answer so I can accept it? –  cporte Jun 19 '13 at 7:15
    
cporte - done... –  Deer Hunter Jun 19 '13 at 7:37
add comment

4 Answers 4

up vote 2 down vote accepted

A recipe:

  • Use "passphrase". (why? - you are promoting the best practice, you may actually want to include a link to OWASP)

  • Add a nice little blurb to the right on why they would want the security that passphrases provide, and other security tips.

  • Use xkcd's "correct horse battery staple" cartoon, but disallow this passphrase.

correct horse battery staple

Rubber-hose security

Note: XKCD cartoons are licensed under a Creative Commons Attribution-NonCommercial 2.5 License.

share|improve this answer
add comment

If seen from user's perspective, then the option of password should be chosen. This is because the user may get confuse between password and pass-phrase. Also he may find it tedious to generate or remember it.

Generating pass-phrase is also a difficult task.

To keep the simplicity in using the system, the option of password is more correct.

share|improve this answer
    
Thanks, but not using passphrases is not an option for us :). I edited the question to be clearer. –  cporte Jun 18 '13 at 10:45
    
Ok Then you may use passphrase in the place of password. Just make sure to specify in short about what a passphrase is, to avoid the confusion of the user. I think this may answer your question. –  talktokets Jun 18 '13 at 10:59
add comment

One way to encourage users to really try and make their password/passphrase more secure is to add an element of gamification into the mix.

If you next to the input fields display a status bar/rank indicator/etc that dynamically rises as the input gets more complex, that can work as an enticement for the user to try and make the password as secure as possible.

The use of phrases rather than character/number combinations is still quite unusual though. So I would suggest that you cap the security ranking on say 3/4 and adjacent to the indicator prompts the user to separate the password with spaces to make the password even more secure.

enter image description here

enter image description here

share|improve this answer
    
Thanks for your great answer! But it not answer my more specific question. I edited the question to be clearer. –  cporte Jun 18 '13 at 10:46
    
Oh dear, are we really going to continue, even promote, a practice that is better changed just because passphrases are still quite unusual? –  Marjan Venema Jun 18 '13 at 16:27
    
@MarjanVenema Well, this illustrates the point though, the second one is the first one broken up as four separate words. So, yea... =) –  AndroidHustle Jun 18 '13 at 17:52
    
:-D ............... –  Marjan Venema Jun 18 '13 at 18:51
add comment

I think I would tend to present the passphrase as a password because average users are not familiar with the passphrase concept. Then, you could clarify in your requirements that the "password" can have or must have a space. I haven't tried that but I would think it is easier to understand.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.