1

When a user is presented with a password creation form of any kind, is it necessary to add parameters to their password so it meets certain security requirements (complexity etc)? These parameters must be displayed to the user so they know when their password is valid but... this also means anyone that's trying to guess someone elses password now has a template to go off.

For example, "you must have at least 1 upper and lower case character as well as a number and symbol."

Does restricting the free choice of a password in a form cause a poor user experience by forcing validation when it may actually have a negative effect?

Improve this question
4
  • A hacker is going to be able to find out what your password requirements are just by attempting to register an account, at which point, they'll be told if they don't meet the password requirements.
    – Chris
    Commented Mar 1, 2018 at 4:40
  • Well sure. The requirements aren’t the secret. The requirements simply ensure that all passwords satisfy a certain strength.
    – maxathousand
    Commented Mar 1, 2018 at 6:15
  • 2
    as stackoverflow user I'm obliged to link the traditional xkcd: xkcd.com/936
    – Boat
    Commented Mar 1, 2018 at 10:50
  • I have this saved already, it's a classic.
    – sclarke
    Commented Mar 1, 2018 at 11:20

2 Answers 2

Reset to default
2

A small inconvenience...

As for how this impacts the user experience, I'd say that it's worth the slight inconvenience to force the user to pick something slightly better than "password" or "123456". Nowadays though, your average user has likely unfortunately found a password that they use for everything, so it probably won't even bother them to meet the typical password requirements.

...to significantly increase password entropy.

By enforcing these requirements, you're ensuring that the user is exploring a very wide set of characters (lowercase letters, uppercase letters, numbers, symbols). Combine that with a minimum length, and you're ensuring that their password meets a certain threshold of entropy.

If it were up to a typical user who doesn't necessarily fully understand how significant a strong password is, they might very often pick passwords that are based solely on what is easy to type or remember.

Improve this answer
2
  • I would add 2 things, entropy grows faster by having a higher character minimum than by adding in other characters (especially true since ppl tend to use the requirements in very specific ways ie. upper case characters are usually at the beginning). Second, it depends on the application, if there is sensitive data then yes you should force a more complex password scheme, however if there is no sensitive information dont add restrictions just for the hell of it.
    – yitzih
    Commented Mar 1, 2018 at 4:43
  • @yitzih agreed. No argument here. My main point was that if users had their way, they wouldn’t usually add numbers or symbols unnecessarily, so many of their passwords would be part of a smaller set of characters. I agree that the Security stack exchange should be the next stop for OP to search around.
    – maxathousand
    Commented Mar 1, 2018 at 6:10
2

I see your point of informing a potential hacker of the pw criteria.

However, from a UI perspective, there's not many things more annoying than being forced to do something wrong before you can do it right. E.g., told in very general terms to create a password, and then told (Hey, Dummie!) you didn't do it right.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.