Should I create a password pattern or shouldn't I?

Question

I am just creating a registration form for my website. However, I can't decide wether to go the secure or the user-friendly way.

I've got two options:

---

The used password must fit into a pattern

This is the secure option. The pattern would consist of a password with a minimum length of, like 10 characters, a number and an uppercase letter.

Pro's

• Secure. The password can't be found out that easy.

Con's

• The user might forget the password because he can't use his usual password. This can lead to frustration and the user might not want to come back.
• The user might get frightened away because he knows he will forget such a password. And so the Conversion Rate drops down.

---

Free choice for the user

The user-friendly option. The only specification of the password would be a length of, like 6 Characters. Everything can be done as the user want's.

Pro's

• The user can use a password he knows and he can remember.

Con's

• Insecure. Hackers can easily start a dictionary-attack and can be successful.

---

Ideas

I could first let the user make the registration only by typing in his name and email. When he clicks on register I could do something "user-binding". After that I ask for a password with a pattern. The user now already made some efforts and he might not leave the site immediately, also knowing his email is already registered and he is just before getting his account.

I also could watch out for often used passwords like 123456 or something similar and block them. By doing that, dictionary attacks by "hackers" can be prevented more or less.

It would be nice to hear your opinion on that. Thanks!

Answer 1

It's not necessarily true that your password pattern is more secure. Difficulty in brute forcing the password increases exponentially with each character, not as much with strange password requirements. I think websites should only enforce a large minimum length, like 14 or 16 characters, but place no other restrictions on the passwords. This is the "best of both worlds" since users can use short sentences or other things that are easy to remember but the length makes it very difficult to hack.

XKCD makes the argument quite well:

Answer 2

I suspect that there is more to think about than just the possibility of a "hacker" doing a dictionary-attack, although this entry on StackOverflow gives useful details.

You might also want to think about two-factor authentication, or even three-factor if the application warrants it.

As J. Dimeo suggests, password patterns aren't really that useful and tend to give a false sense of security. They are also extremely annoying sometimes.

Personally, I recommend allowing a pass phrase, rather than a strict pattern. For example, "Run you clever boy and remember" is much easier to deal with that "Tr0ub4dor&3" to borrow the XKCD example.