I am just creating a registration form for my website. However, I can't decide wether to go the secure or the user-friendly way.
I've got two options:
The used password must fit into a pattern
This is the secure option. The pattern would consist of a password with a minimum length of, like 10 characters, a number and an uppercase letter.
- Secure. The password can't be found out that easy.
- The user might forget the password because he can't use his usual password. This can lead to frustration and the user might not want to come back.
- The user might get frightened away because he knows he will forget such a password. And so the Conversion Rate drops down.
Free choice for the user
The user-friendly option. The only specification of the password would be a length of, like 6 Characters. Everything can be done as the user want's.
- The user can use a password he knows and he can remember.
- Insecure. Hackers can easily start a dictionary-attack and can be successful.
I could first let the user make the registration only by typing in his name and email. When he clicks on register I could do something "user-binding". After that I ask for a password with a pattern. The user now already made some efforts and he might not leave the site immediately, also knowing his email is already registered and he is just before getting his account.
I also could watch out for often used passwords like
123456 or something similar and block them. By doing that, dictionary attacks by "hackers" can be prevented more or less.
It would be nice to hear your opinion on that. Thanks!