Should password complexity be shown at login page?

Question

I believe most (or at least: many) users have passwords pretty much standard - they tend to use even literally the same password for most of the systems they access. This is insecure, of course, but the lack of need to remember multiple password, use a software to store them etc. causes it anyway.

Let's just assume the usual password of our John Doe is "johndoe1" - it consists of 8 characters, including a number.

Now, let's say we have a system that makes user choose a "strong" password. The password policy is to include capital leters, numbers and at lease one special character. This makes John modify his password from "johndoe1" to something like "JohnDoe_1" instead.

John does his stuff in the system then leaves, or is logged in automatically every time based on a cookie setting. Any of these scenarios does not require from him to use the password again for a long time. When John gets back to the system, he enters his login and the standard password ("johndoe1"), which of course does not work.

So he needs to reset the password. Some really nasty systems won't allow him using the password he had set before (e.g. Microsoft account, if memory serves), so he needs to come up with another one, which makes the situation even more problematic next time.

Should John be presented a clue about the password complexity at the login page? Would it prevent him form failing on log in process and thus make the whole experience significantly better? Are there any examples of such pattern?

Answer 1

I have seen at least one solution like that but I can't recall where (will try to remember). My first thought was that is was brilliant, but then it struck me that it had halted my login because it made me think.

In that solution, the pwd-requirements showed up as bullet points beneath the pwd-field when it had focus. I think this can be improved a lot by not showing the reqs until after the first failed attempt. That would impact the general flow less and still provide value.

A warning though: If the requirements for the passwords (in registration) are changed at some point, you will end up with a legacy that might be hard to deal with in a good way (i.e. which requirements should be shown in the login). You would probably have to remove this feature then anyway for security reasons.

Answer 2

One of our developers has actually done this. Apparently he found a password input component somewhere online and used it in a login form, so once you've typed the first character, it tells you "password too short". It's incredibly annoying. (But it's a very early build and it won't launch like that).

For us, who know what's going on, it's annoying. For users who don't know about reusable components it might be both annoying ("I'm not done typing yet, why are you shouting at me?") and confusing, since this is a very unusual behavior, which might be interpreted in a number of ways.

-Login forms don't behave this way. Maybe I'm on the wrong page?

-Is the page trying to validate my credentials on the fly? Will it say "password too short" up until I reach the exact number of characters in my actual password? Will it say "too long" once I exceed it? Is that safe?

-Will it say "wrong password" if I make a typo?

All these questions can be answered immediately by trial and error, but there's no reason to make the user go through this process.

Answer 3

Should John be presented a clue about the password complexity at the login page?

My thought process as a user would be like you described. First I would try my common password. If that fails, I'll sit and scratch my head for a moment. My thinking is that the first failure is the opportunity for clues.

Would it prevent him from failing on log in process and thus make the whole experience significantly better?

Some systems might let the user type a clue themselves about the password. In that case you could even prompt the user something like "Do you want us to e-mail your password clue to you?" Then you can send the clue to the e-mail address on record for the username. I would think of this as an intermediate step before taking the user down the path of resetting their password.

Even without this, it would be easy to collect data and see how many users get their password on the second time now, and how many get it on the second time after you reveal a clue about complexity. I would be interested to see the results of this.

Are there any examples of such pattern?

This scenario makes me think of systems that add the phrase "Is your caps lock on?" after the first failed password entry.

The question "Is it good practice to warn users that capslock is enabled when entering passwords?" is good reading. Specifically, the idea that Facebook accepts three forms of a password to "help overcome the most common reasons that authentic logins are rejected". This strikes a good balance between security (the passwords are not case insensitive) and user experience (the most common cases are taken care of without the user even knowing).

Answer 4

I've come to experience, and expect, most login pages and dialogs to be clutter free. I'd view a password complexity hint as a novelty. Not necessarily a bad thing, but a novelty nonetheless.

Also think about your audience, if you were making a login for geeks.com this might be appropriate but in some other cases like a shopping app you will probably want to keep the interface simple.

I agree with Babossa's point that if you do go ahead and implement that, not showing such a hint until after a first failed attempt.

Answer 5

While this would be a good user experience per se, most information security groups would probably discourage it because it is also making it easier for a hacker to figure out the password. In the PCI guidelines (Payment Card Industry that keeps us safe while we make payments) it gives a recommendation to not even have an error message that tells the user the password is incorrect. It prefers that vague error message is presented to inform the user that the information cannot be validated.

Just a different perspective on the matter.