3

I'm an advocate of lesser cognitive load process, moreover when this process includes lots of forms and steps. I think we all are at some point.

The password step by itself if usually full of pain point because some users are not technical as we are (obviously) and when you ask them to use at least one special characters, and you don't aspect the "_" as a special one, well, it's kind of disturbing.

My point isn't in the "what should be a special character?", but more of a "why do we really care of what the user typed in this field?"

My questions are the following:

  • Why would you ask for a precise pattern for a password, since you know it adds a lot of cognitive load for the users, as well as the need to handle error cases in terms of design and development?
  • Is there, in your opinion, a better way to do it?

Below, my thoughts as a first answer. Feel free to vote up or complete by answering.

4

Just ditch the password.

Let users provide their E-Mail Adress (and phone number for 2FA) and send them a login link/token if they want to log in.

The best password no password at all.

2
  • I also like this system. It's perhaps a bit annoying to some users, but it is extremely clean. The key is that signup needs to email the user a verification link to confirm the email is legitimate, as well as (or alternately) message their phone a token that must be entered. The goal of both is to prove the user has access to the email and/or phone at time of signup. It does a malicious person no good to sign up using another person's email, as all subsequent logins also require the email. Same goes for passwords.
    – Tim Holt
    Feb 9 at 4:51
  • Thanks for your contribution @htho 😊 Apr 2 at 8:39
2

Here are my thoughts about it, but I'm here to listen to your opinion too on this. Thanks for the help!

Why would you limit the user in using specific characters in the first place?

That's my first question, on oftentime I got these excuses.

"It's for Security reason"

More special characters don't make your password more secure, the longer of the password is more important than the type of character. For instance, for security and usability reasons, it's more effective to use a passphrase as password, than a complete to remember password with a lot of specific characters. (source)

Image from Dropbox illustrating password strength

Image from Dropbox article.

Usability reason

A passphrase that makes real sense for the user will be easier to recall. Motivate the user to use a longer pass with a gauge to evaluate it strength. It will have a double positive effect:

  • it will be easier to recall
  • longer passphrase means less need to change it often

Also, when you need to read all the requirements to create a "good password" you add frustration and make the user lost their initial goal:

  • people are more likely to forget instantly the beginning of their password and hit the "I forgot my password"
  • complex password for computer to guess are also too complex for users to remember > "I forgot my password"

Then users look for a way to not having to recall the password, and if a "remember me" option is there, they will use it, making their account easier to reach.

Latin alphabet-centric solution / Inclusivity

Not allowing all the characters is oftentime limiting the range to "latin characters" which most of the world find totally egotistic. For a more inclusive way to think about that, just allow everything.

Alternative solution

I found a first solution that I tried to implement for users that are really really not "power users", in this solution which advise your user by educating them:

  • Use a gauge to show the password strength. Plus: people love to play with it.
  • Add advices alongside user's typing the password.

An excellent implementation of that is Dropbox solution. I totally recommend the reading. You can test it in a technical aspect here: https://lowe.github.io/tryzxcvbn/ and it proposes suggestions while typing.

I hope this topic will awake your curiosity and bring some good solution on this 20yo problem 😅

3
  • I also never understood why developers like to limit the set of characters and/or the amount of characters. Most special characters need to be escaped, maybe they are afraid escape mechanisms work differently? It makes sense to limit the amount of characters because hashing functions usually require a multiple of X characters. There are strategies to hide this requirement from the user.
    – htho
    Feb 10 at 19:46
  • Sorry, but I can not resist ;-) Robert Morris and Ken Thompson already described the problems with passwords in 1979 and the Publication is called "Password Security: A Case History" (rist.tech.cornell.edu/6431papers/MorrisThompson1979.pdf) - The problem is waaay older than twenty years ;-)
    – htho
    Feb 10 at 20:10
  • Yeah I'm sure of that, this was a humoristic formulation, but I'm sure you got it ;p Thanks for the PDF source btw. Apr 2 at 8:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.