2

To provide the context, we have updated our password policies to disallow commonly used passwords like “Password1”, “Welcome123”, football teams, first names and easy to type keyboard sequences etc. and we would like to provide a specific error message so that users are aware of why even after having the required pattern being followed we are not allowing the input password.

So now, although we would like to provide relevant details however at the same time we don't want to provide a huge message which in turns become a bad user experience and the fact that it will be impacting large number of users, I just want to ensure that it is delivered in best possible message. All inputs are welcome and would be happy to provide further details if required.

enter image description here

Improve this question
3
  • The case is for sign up passwords or do you refer to already existing accounts with already accepted password?
    – Alvaro
    Commented Feb 16, 2017 at 10:36
  • 1
    The password selected is a commonly used password. Please select a more unique password.
    – paparazzo
    Commented Feb 16, 2017 at 11:51
  • @Alvaro it is for the already existing accounts as well as for the new registrations.
    – dShringi
    Commented Feb 16, 2017 at 15:33

2 Answers 2

Reset to default
3

Use Password Strength Indicators along with indicating progress toward compliance -

enter image description here

This is from the NNGroup:

Apple.com and healthcare.gov show you how many hoops you’ve jumped through and which ones are left. A slight copy change could nudge users into feeling more motivated, less bogged down, as they type.

https://www.nngroup.com/articles/password-creation/

Improve this answer
1
  • Thanks Dipak, this looks really promising to me and I believe should be the most appropriate way to implement the feature however given the way we have been asked to solve it and the scope of the solution we are only updating the message to be displayed.
    – dShringi
    Commented Feb 16, 2017 at 15:45
0

It looks like there is an extra requirement that is not listed in the requirements the user sees before entering the password.

commonly used passwords like “Password1”, “Welcome123”, football teams, first names and easy to type keyboard sequences etc.

You could indicate this in the requirements and then inform the user that his password is not fulfilling X requirement.

Improve this answer
4
  • There are couple of reasons for not mentioning the same. 1. On the login screen if we show the user what passwords are blacklisted, the attacker would know what combinations he needs to avoid and it will only help him. 2. It is a huge list which cannot be displayed on login screen.
    – dShringi
    Commented Feb 16, 2017 at 10:37
  • @dShringi You don't need to include all the cases but just an example, actually what I quoted in the answer might be enough. About the attacker I certainly don't know enough (Information Security SE for reference).
    – Alvaro
    Commented Feb 16, 2017 at 10:43
  • Thanks for the Security SE reference Alvaro, I will check it out. Now, giving it a thought based on my own experiences, I have never seen such examples being provided as a message and on our part the reason for not providing the examples is the fact that we do not want to reveal what kind of passwords are blacklisted.
    – dShringi
    Commented Feb 16, 2017 at 10:52
  • As Alvaro said, a statement along the lines of "Please avoid using common easy to guess passwords, football teams etc." Tell the user upfront rather than penalise incorrect actions.
    – DarrylGodden
    Commented Feb 16, 2017 at 11:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.