1

I am trying to think of the best requirements to set a password for a customer relationship management cloud software service. A credit card is stored on the site, which is only useful to the site owner i.e. if someone else logged in, they wouldn't get much benefit.

So here are my options:

  1. min 6 character password - simple and easy, they can use their favorite password, and won't struggle to remember it.

  2. min 8 chars, 1 upper case, 1 number, 1 non-alphanumeric character - secure, but it gets annoying, and if you forget the password, it's hard to remember.

  3. min 6 chars, 1 number, 1 upper case - somewhere in between, a bit more secure, and a likely chance they can still enter their favorite password.

Thoughts?

Improve this question
2
  • 1
    Honestly, with information like CC number stored on the site, the security should be stronger than a mere single factor password based authentication. Whichever option you decide to choose among the above, I would recommend a 2FA setup so that you can clearly ensure that the user gaining access to the CC number is absolutely the one you have authorized access to.
    – ikartik90
    Nov 18, 2020 at 8:23
  • I am going to suggest that you post this on security.stackexchange.com and see what the response is here.
    – Tim Holt
    Nov 19, 2020 at 5:40

4 Answers 4

Reset to default
2

I would go with option 2. Eight characters is what Microsoft and the NIST requirement recommend.

Improve this answer
0

Let me preface what I'm posting with this: you are thinking that short weak passwords would be nice so that the user has a good user experience with their login. But consider the user experience if their account is compromised or the whole site is compromised - that experience is far, far worse than the minor annoyance of a more secure password.

In terms of your 3 options, I would say 1 is absolutely a terrible option, 3 is very bad. People don't have 6 character simple passwords as their favorites. Anyone who does have a 6 character password as their favorite is at very high level of risk already. Additionally, it's somewhat trivial to brute force a 6 character password.

Also against 1 and 3, if you do allow for weak passwords, users who are conscious of security may very well choose to not use your site because they feel you are not serious about security.

Remember that the purpose of a password is to keep the dishonest out. If all you cared about was letting the user identify themselves, you'd just have them type in their email address or user name.

All that said, number 2 is decently secure. Don't worry about people forgetting it - many people let their browser remember the password, and many people (unfortunately) reuse passwords on multiple sites. Almost any site that users interact with now days and entrust with any important information will enforce these kinds of stricter password rules. Users are used to it.

Irrespective of whether the CC can be accessed by the user, you will create a security risk for your site by allowing anyone in with a weak password. Your site may have security holes that allow a logged in user to access data that they should not have access to. You may think your site is secure, but then so did every huge company out there that's been hacked.

PS

If you don't want people to have to remember a password, consider alternative approaches such as login via link in email as described at https://stackoverflow.com/questions/4653903/instant-login-from-email-why-have-so-few-done-this. Or you might use some kind of one time access token that is sent to or generated by their phone.

Improve this answer
0

Based on the understanding that credit card information has to be stored in the account and that the software service involves holding client information, option 2 should be the best option.

And I'm not sure why you have the idea that option 2 can get

annoying, and if you forget the password, it's hard to remember

when in fact I feel that most e-commerce websites and work applications in the market these days commonly use 8-char "alphanumeric Upper/Lower case + symbols" requirement on password setting. I feel as an user I have gotten use to this level of complexity in setting my passwords.

If your application is for mainstream consumers and do not store sensitive information, then probably options 1 and 3 will do just fine.

Improve this answer
-1

Every restriction you put on passwords makes more user have to figure out a new password for your site. And make them reset it every time they try to get in and fail. And, most likely, just give up and not come back.

Your option 1 has the only restriction that makes sense, a minimum length and nothing else.

Improve this answer
3
  • But it's highly insecure, which risks both his site and the customer.
    – Tim Holt
    Nov 19, 2020 at 5:38
  • Because we're in a UX group, I assumed the "requirements" were UX requirements. It's not our job to make security requirements, but to present the best user experience and work out with the security team what level of security is required and how that can be reached with the least amount of bad UX.
    – Ken Mohnkern
    Nov 19, 2020 at 14:37
  • It is much easier to exit a tall building quickly by jumping out of the window, thus creating a vastly more effective user experience than say, waiting for an elevator or taking the stairs. But longer term, it's a terrible user experience.
    – Tim Holt
    Dec 5, 2020 at 0:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.