How do we tell a user that when they logged in we noticed their password was insecure?

Question

I'm not entirely certain if this belongs on Information Security or here, so if it needs moved I'll delete it and repost.

---

An application I'm developing has a "feature" that alerts a user when a password they logged in with does not meet the password requirements. While this is not a common situation, it is possible that the password requirements were hardened after the user last changed their password. We test this on login, by validating the password they logged in with against the new requirements. If the password does not meet the new requirements, login is allowed but we inform the user via. a somewhat ugly message that their password doesn't meet the requirements.

The message, for those who cannot view the image, is:

It looks like the last password you logged in with doesn't meet our requirements, we would really appreciate it if you would visit the @Html.ActionLink("'Change your password'", "ChangePassword") page and update it to meet them. Until then, we'll show you this reminder each time you login.

It's completely dismissible, and that works for the duration of the current session, so if you log-out then back in it will show up again, or if you log in on a different device it will appear again. However, if you do anything to update your password to conform to the newer restrictions, we remove the message as soon as that happens, so if you are logged on on three devices, and change your password on a fourth, the three others will have that message disappear on the next page load.

I'm not sure what is best, because any message implies that we don't store passwords securely (we do, we only test this on login and then flag the user profile), so I'm curious if there is an accepted behavior when it comes to this.

I thought about adding a tool tip that says "How do we know this?" and when the user hovers, explaining what method is used to show the message.

Every time you login we re-test your password against the policies configured in this website, if your password no longer meets these policies, we alert you. We also validate your password against recent data-breaches, to ensure we can provide the safest experience possible.

Answer 1

I would recommend simply redirecting all users who set their password before the new requirements to a "change password" page after they log in. Provide a message at the top of the form informing them that your password requirements have changed, and all users are required to reset their passwords. If you conduct some quick tests with the design of this page, you might find that people have concerns about a breach or something, and you could address those in the copy. Clearly show the new requirements, too, of course.

In my opinion, there's no need to broadcast the fact that you know anything about someone's password. Setting a new password may be inconvenient but it is not uncommon to be asked to do so (periodically, upon an update to the system, etc.).

Answer 2

How about just testing length and displaying that in the warning (even if other policies exist).

• That's the way to make a password the most secure anyway (longer length exponentially increases the difficulty of brute force hacking it, and other requirements like special characters make it harder to remember and more likely to be shared across sites or written down)
• The user is confident that you are following best practices, because the length is self-evident in the password text field (you didn't need to know what the password actually was to display the warning).
• The warning clearly diagnoses the problem and is easy to fix, instead of the unspecified "requirements" (it's frustrating to not know what is wrong with the password)

e g.

Your password is too short to meet our password length requirements. Please go to the "ChangePassword" page and choose a longer password at your earliest convenience.

Alternatively, or if the current password meets the length requirements but fails other requirements, consider showing a time-based message i.e. "Your password was last changed X days ago...". Once again, highlighting a single problem that is easy to fix and doesn't remind them that you know their password (during login).