0

We have a password input for both our login and signup pages. As the user types their password on the signup page, they will see something resembling the following:

Password popup showing validation

Note: Our password input doesn't have the strength text.

My question is, would having the same password input on both the login and signup pages have a negative impact on the user experience? I assume there is a good reason other websites don't do this but I'll list the pros and cons as I see it.

Pros

  1. Immediate pre-request validation
  2. Knowing the requirements may help the user remember their password

Cons

  1. Additional clutter on the login screen
  2. Password requirements may change after signup
  • Why are you forbidding spaces? – Andy Mar 25 '19 at 14:43
  • The user does not need to know the requirements for creating a password, because they aren't creating a password - they are simply signing in with an existing one. – Ivo Coumans Mar 25 '19 at 14:48
  • If you ever relax your password requirements (which you should because you're enforcing old/insecure password rules) then the hint would become misleading on the login screen because the user may be grandfathered in with an old password. – sharkonaut Mar 26 '19 at 9:01
0

These password restrictions are actually bad user experience to begin with. This in turn undermines your security efforts because users find an unsafe work around.

They write them down, and re-use passwords across services.

Longer passwords are more secure than short cryptic ones, and whole sentences for example would be easier to remember, and more secure.

Password-less logins are another user friendly alternative. This could be a login-link that you send by mail, or a Single Sign On. If you're on a web application, there soon will be Web Authentication

Another thing to consider is that more security-aware users make use of Password Generators, and you'll potentially reject those generated passwords.

AF$rf/abc-{P Your password doesn't contain a number.

Do you feel the frustration?

Given you stick to the restrictions, I think it's a good idea to provide the hints again, as you say, it can help users remember their password.

0

I am not entirely sure about the UX implications of having the aforementioned pre-validation of passwords at login, but I am sure about the security implications.

Anyone trying to hack an account will get convenient hints for what parameters to use to break the password

It is safe to assume that the user remembers their own account's password and its criteria. If they don't, they can use the Forgot Password option to retrieve/reset the password.

Why are such validations implemented during sign-up process? - Because the users need to know what password(s) will be accepted by the system.

  • 1
    I don't quite understand the security implications, the hacker can just go to the sign up page and see the password requirements there. Is the extra step supposed to mitigate attacks? – Phillip J. Fry Mar 25 '19 at 13:54
  • Password is like a key to your house. Just like you wouldn't leave a trail of breadcrumbs to the spare key of your house, you wouldn't want to give out hints to another user about your password. Keep the password private at all times. Also, @Andy has made a good point as well. It's not good UX to limit the user to a certain pattern and definitely not good for security either. Refer to the answer in this post -> ux.stackexchange.com/questions/80701/… – Shreyas Tripathy Mar 28 '19 at 10:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.