4

We all know them: password, password123, and letmein are all fairly common passwords and are easy to guess. Still, people use them. Would it be a bad idea to not allow users to use common passwords? I could display an error message with a list of "bad passwords that you cannot use."

Should I allow my users to be able to do simple passwords, only warn them, or should I not allow them at all? Some of the passwords above are probably tried with most cracking software first. I'd imagine that most users would be annoyed, but this is the last "flaw" I can see in my software as far as trying to get in without the password. There's always going to be the problem of someone telling something else, it getting written down, reusing passwords, etc. That's inevitable.

Of coarse, hackers could read a list of "banned passwords" and decide to not use those, but that would be harder for a bot to realize that, and I'd imagine that they'd move on unless they're targeting a singe account. Is this a bad idea or is it fine?

Improve this question
3
  • 1
    While this won't answer the question directly - I'd add that people's perception of the importance of security varies from site to site. IMHO- people are more likely to provide a more secure-seeming password for something like a banking app or commerce site vs any non-commerce related site that contains little personal info. If one gets hacked on the former, the personal impact is greater.
    – Pdxd
    Commented Mar 28, 2014 at 3:26
  • 1
    What is the context of your site / application?
    – Pdxd
    Commented Mar 28, 2014 at 3:28
  • 3
    My wife always uses the same weak password, similar to ones you mentioned. Can't break her of it. She uses sites that don't allow that password less frequently because she forgets the password and gets locked out. As Pdxd said, if your site is just a forum or something without personal info, let your users have their terrible passwords. If it involves money or SSNs, you should probably block the bad passwords.
    – thunderblaster
    Commented Mar 28, 2014 at 17:27

3 Answers 3

Reset to default
6

From a security prospective this is the right thing to do. While you won't make your application hacker proof, at least you make them work for it ;)

Often the reason for people to choose very simple passwords is that they see those as easier to remember. Why don't you instead suggest easy to remember yet complex password? Maybe suggest a password phrase that can be hard to crack but easy to remember.

xkcd

Improve this answer
0
3

A weak password in one's head is more secure than a strong password in one's pocket

This was apparently proven by the American military in a research they did back in the 60s.

Forcing users to change their passwords periodically is counter-security, so is forcing passwords that have too many restrictions (eg, upper case + lower case + number + symbol).

If you do have password rules, it is advisable to show them during both registration and login. Oblique password rules lead to oblique passwords that users don't remember and they end up trying many other passwords, which in itself could be far more dangerous than if anyone will hack the password for the system they are trying to login to.

Improve this answer
3
  • 2
    That is an awesome quote, however in the sixties there were no GPUs doing 8 Billion Hashes per second, so they might have to do that research again. ;-)
    – TheUser1024
    Commented Mar 28, 2014 at 17:10
  • As a counterargument pointed out by Bruce Schneier, people are pretty good at keeping paper items safe: bank notes, passports, etc.
    – Ulrich Schwarz
    Commented Mar 29, 2014 at 8:32
  • You might be referring to the practice of setting launch codes for missiles to 0000 )
    – Deer Hunter
    Commented Mar 30, 2014 at 6:21
2

Writing down passwords is not inevitable. You have other options:

Offer a password reset feature. Forcing a user to reset their password is not required. "You should use a better password. If you lose it, you can reset it here." In fact, it can be argued by precedent that password confirmation fields are not even required.

Use google or facebook for OAuth. These companies make it their business to safeguard accounts in additional ways that non-giant internet companies cannot. They are also extremely convenient.

Suggest a strongly-encrypted password keeping service. They work, they're safe, and they protect people from themselves without extra effort.

If you use client-side validation show the user their password is junk, your log-in flow won't be disrupted. The message will appear, your users will correct their mistake without a second thought, and everybody wins.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.