Would it be bad design (and unsafe) to put password guidelines next to a login box?

Question

Different websites have different password requirements

• Some are content with a combination of just lower case words
• Some require a combination of lower case and upper case words
• Some require numbers in your password
• Some require special charecters

Now I have a number of different passwords modified to suit the website requirements but I often get mixed up about whether the password was

word@%(some numbers) or just word(some numbers)

and I end up often resetting my password or not even logging in.

Now my question is would be wrong or bad design to display the password guidelines next to the login screen ? I understand it might actually make it unsafe to an extent since it also gives guidelines to someone with malicious intent about how a password might be structured but is this a case where security trumps usability or what is the equitable balance between the two.

Edit: Please note that I am talking about the scenario of password guidelines being displayed when a person is trying to log in (having established an account) and not when he is trying to sign up ( I strongly believe password guidelines are very important then)

Answer 1

I think it's a great idea!

On numerous occasions I have forgotten a password, and made as if I wanted to create a new account in order to see the password guidance and determine what rules I might have used in order to create my password in the first place. (Yes, I'm aware of various options to manage my passwords.)

Sometimes that even involves having to use another browser on which I've never logged in before. (Stack Exchange is especially annoying because a proper log out actually logs you out on all devices, not just the current browser. I don't want to log out unless I'm sure I can remember my password.)

So here's an example from UPS of where it would be useful; you get a great big list of password restrictions when you create an account:

When you log in later, all you get is this below (you already entered the username on a separate screen!). There's loads of space and it would be so easy to use the same password hints on the login screen. The log-in screen is available from the home page so it's not like this is hard-to-find information, and anyone doing any real jiggery-hackery will be well aware of the restrictions anyway — they're not daft, not by a long shot.

So, yup: go for it. Great idea!

Answer 2

I solved a similar login / password problem based on info that I was receiving from operators in our customer service department. Prior to my arrival, the login screen only had user/password/token password fields and submit button, not one word on how to prompt users to remembering their logins. A large chuck of CS calls were reduced by simply adding footnote copy reminding users that passwords included characters, plus atleast 2 numbers and a special character.

User: [Text field] example: Johndow (username field is not case sensitive) Password: [Text field] Reminder: Passwords contain 8 - 16 characters plus 2 numbers and 1 special character.

We also tested the [checkbox] reveal my password, which showed a user what they typed for verification. This also reduced password concerns. I'd post my wireframe, but can't do to low answers. Which as a user would have been nice to know ... prior to trying to post (just sayin ....)

Answer 3

From a Security perspective – No. From a User Experience perspective – Yes. That’s often the problem when different goals meet in the middle, which one is most important. As this is the site of User Experience, the popular answer is to show users what the rules are. That is fine as long as your security requirements are met.

The potential security issue, when you make password rules public, is that you narrow down the options for hackers, who can fine-tune their algorithms by only testing valid password strings. However, this can be compensated by using longer passwords/pass phrases.

Passwords don’t have to be UPPER CASE, $ym8ols or numbers. Passwords can be strong if they are long enough. In addition, both of your goals have been met making the accounts secure and useful.

Answer 4

I would avoid it; it might work for now, but things might change. There are two issues with that:

1. Changing guidelines. If your guidelines change (e.g. to become stricter in future), do you print the new guidelines or the original ones? If you print the new ones, you're no longer helping the user remember the password they chose. But if you print the old ones, that leads on to the second problem:
2. Changing security setup. Your old guidelines might get out of date. Even if they're currently in line with good security practice, things change; in a few years time, security good practice might have changed so that your guidelines show your site to have what has become an outdated and insecure security model.

Answer 5

Different people have different ways of remembering things, so what may work for you may not work for another person. There is no one correct way to build a password.

Password-breaking software use brute force, dictionaries and oft-used password combinations to break a password, hence the necessity of recommending some good practices when creating a password. But giving a detailed instruction on how to build a password, and then reminding this instruction upon failing to write the right password, will be unsafe: ill-intended people can use the instructions provided to build a specific program that will have better chances to break passwords.

It is better to give broad recommendations on how to build a good password. In fact, the Password Strenght Meter is a known design pattern, that normally complements the instructions you mentioned on how to buid a good password.