What is the best way to inspire users to choose strong password?

Question

Most of the users use weak passwords. They may use weak passwords even for services where they store sensitive information. I think it's because they don't believe that their password may be guessed/brute forced. But they may be furious if it happens. To avoid this furiosity we are going to build very strong password requirements.

I understand that most of the users may be quiet displeased with necessity of choosing strong password so I want to provide them data why they have to do it.

I thought about tooltip like:

Our service is for sensitive data. Your password is the gate to your data. If password can be guessed or brute forced by attacker, he will have full access to your account. It happened many times with other sites in the past:
[chronology of the largest password leaks (Sony, Citigroup etc.) is here]

What is the best way to inspire users to choose strong passphrase and remember them?

Edit: I was advised to use password meter.
Say, my password requirements consist of 5 rules. I think about the following meter: When user starts typing, all 5 rules are displayed next to password field in red. As soon as user types password that falls under some rule, this rule disappears from this area. As soon as all 5 rules are satisfied, word "Strong!" is displayed instead of rules in green.

However, using password meter doesn't tell user why they should use such strong password. Should I provide such info to them? If yes, in what form? Is there a way to have users not dissatisfied because of strong minimum password requirements?

What is the chance that in case if user's password will be guessed by attacker, user will blame application developers that they didn't force him to use strong password?

Answer 1

It's not uncommon for sites to display password strength (weak medium strong verystrong) next to the password field.

What if you did something like this - but instead display "time to crack", an (arbitrary) estimated length of time for the password to be cracked, together with some commentary.

[password      ]  Cracked in: 1 minute 
                  You've selected one of the 10 top poor passwords used online

[password16    ]  Cracked in: 5 minutes
                  A simple numeric suffix on a common password adds little safety.

[mummyDearest  ]  Cracked in: 12 days
                  Using a pair of words from a standard dictionary has medium security.

[GonatfItbolwm ]  Cracked in: 8 years
                  No dictionary words plus mixed case, strong security

The downside is that the algorithmic complexity of doing this quickly enough might be more than the feature is worth.

Answer 2

There's nothing MORE ANNOYING than dictating me (a user) what password I should choose. I good example of such annoyance is this site's log-in system.

Although there are benefits of automatically preventing passwords such as "123456" and "password", here's my reasons against forcing super strong passwords:

• Unless your system is something that a user has no choice but to log in (like a corporate network), a user will be very likely to leave it and go somewhere else.

• A user will most certainly write down your forced password on a sticky note and plaster it to their computer screen, or email it to themselves in an open text form. How about that for safety?

• A user will be more likely to have their web browser automatically memorize your password. This is very dangerous because in a sense a web browser will store a full form of the password in a text form (scrambled in a sense) but still very vulnerate for a trojan/worm attack.

• Even if you make a user to set up a strong password your system will still have a weak link, i.e. user's email account that you have no control over, and I can guarantee that a user's password there is not as strong as you may force them to make.

• Unless it's a bank, it just makes it pretty cumbersome to log in to sites that require all that password strength. Think of user experience.

• So even if you set up the system to dictate strong user passwords the practice shows that the actual "leak" of sensitive user information may come from within your organization when one of your company's employees loses a laptop jampacked with unencrypted or unprotected data in an open form. Or your weak internal firewall will be no match for some skilled hacker attack that would leak megabytes of unprotected data before you know. This is what happened over and over in the past and this is what you should be worried about.

And lastly how I'd suggest you protect your "butt" against possible user claims:

• Let users choose most password they like. Set up your automatic system to reject most obviously bad passwords like "123456" or "password" or all spaces.

• Set up your automatic system to check user passwords for complexity and issue a well visible warning that a user sets up a weak password and that they are doing this at their own risk, but LET USER continue with the password of their liking.

For instance passwords such as "mycat81" should NOT be considered as weak. The reason such password is better than any of your forced passwords is this:

• A user is likely to memorize it and NOT write it down and leave it on his/her desk.

• A user will not be annoyed with your log-in process and label your system as "complicated" or "hard to use."

• You'll end up paying less to your tech support people for dealing with resetting forgotten passwords or sales reps for dealing with cancellations and problems.

Answer 3

An interesting article about making usable and secure passwords suggests that password based on sentences with 3 or more words such as "this is fun" are ten times more secure than cryptic combinations of numbers and letters such as "J4fS<2".

I think the root of the problem is that passwords such as "J4fS<2" are hard to remember for users, so they get annoyed when you force them to set these kind of password (and also when they fail to remember them later).

You can encourage the use of sentence-based passwords as the ones described above. In case you provide an example of this kind of password, check that the example password is not used.

Answer 4

Wikipedia says "People are notoriously remiss at achieving sufficient entropy to produce satisfactory passwords." (http://en.wikipedia.org/wiki/Password_strength#Human-generated_passwords)

A password meter isn't very reliable, either. They typically have rules that stop me from using very good passwords (a long, randomly-generated of lower-case letters, easy to type on my smartphone) while allowing many weaker passwords.

Meanwhile, the more complex the password, the more likely it is that a user will write the passwords down in an obvious location, such as a sticky note on the monitor.

Regardless of how strong the password is, if the user uses it in multiple systems, you expose yourself to attacks via those other systems.

One way to make sure your users are using strong, unique passwords is to generate the password for them, or at least provide them with specific instructions for doing so. While you're at it, make the password easy to remember or type.

I normally use LastPass to track and generate my web passwords. Since I never have to handle those passwords, I let it generate very long passwords. (Rude look at the sites that limit password length!)

When I need a password that I can remember, I use diceware. Alternately, you could point your users to diceware; you could generate diceware-style passwords for your user.

If security is very important, consider 2-factor authentication.

Answer 5

Discussions of passwords rapidly devolve into arguments about entropy, rules and the concommitant user experience issues. Before deciding how best to advise your users, I think there are two simple question to ponder upfront:

1. Why do you need to get into the business of identity management? We have left the days of "one password for every site" in our dust. Unless you have a very compelling reason why it is necessary for your users to establish a new credential/identity on you site, delegate this to the dominant players (openid, twitter, facebook, google..). There is no downside in terms of development effort (arguably cheaper over time). And the password problem just evaporates; you'll likely get more sign-ups because registration friction is massively reduced too. Tools like JanRain Engage make it dead simple for developers to support multiple authentication schemes.

2. The elephant in the room when it comes to password integrity is the simple rule "don't use the same password on multiple sites". Unfortunately, password strength meters cannot account for this. But give then choice of (a) a unique but lousy password for each site and (b) a single really strong password that I use on all sites, then (a) is best by far.

So if you really need to setup your own authentication and identity management scheme, you will do best for your users by not trying to be the wikipedia of password algorithms. Even if you just focused on the simple message of "create a unique password for this site" you will be doing a world of good. Password strength meters, advice on how to create a password etc take a distant second to this message IMHO.

btw, here's a good site for testing password haystacks (where you can prove that "Hello World" is algorithmically mega-order of magnitudes more secure than "23cd1234234")

Answer 6

Yes, you should provide the rules to your user - it's very irritating to be told that your password isn't good enough without knowing how to improve it. If you require N characters, of which 2 numbers and 3 symbols, say so and give an example.

If you have an actual need for very strong passwords, provide a link to a suitable password generator, as drumming on the keyboard does not create randomness. Also explain that if you provided the password, someone in IT could know it, which would defeat the purpose.

Answer 7

The problem of passwords security can be divided to the following issues:

1. Not preventing the user from choosing secure passwords.
2. Indicating complexity to the user and the meaning behind it.
3. Helping the user choose secure yet rememberable password.
4. Preventing leakage of password.
5. Preventing hacking of password.

Points per issue:

1. Not preventing the user from choosing secure passwords:

   • Let users choose long passwords (8-50chars) and let users choose special characters.
   • Do not accept passwords with characters that are not in the standard ASCII set of 32..126 (from ' ' until '~') as the user may not be able to renter password on another machine or keyboard.
   • The longer the password is the less complex it has to be character-type-wise.

2. Indicating complexity to the user:

   • Provide a complexity indicator (function of length, dictionary words and types of characters (lower case, upper case, digits, symbols).
   • Let the users know what can happen if their account is hacked.

3. Helping the user choose secure yet rememberable password:

   • Suggest methods of conceiving secure passwords that are easy to remember.
   • Enable OPENID - so the user does not have to remember multiple passwords or passwords for a one time usage of a site.

4. Preventing leakage of password:

   • Recommend that the user does not use a password that he/she has used elsewhere.
   • Only enable secure logins (https).
   • Notify users that your employees will never ask for their password.

5. Preventing hacking of password:

   • Do not enable more than 5 failures in a row from a given IP.
   • Do not enable more than 5 failures in a row for a given username.

Answer 8

Reward customers who select difficult to guess passwords or who enable methods such as Two Factor Authentication. Depending on your site/business, this might include early access to features, a free giveaway or even discounts on products. (Mailchimp are currently offering a discount for activating Two-Factor Authentication. )

Users will do something hard if there is a clear benefit to them. For most users, setting a harder to remember password has no tangible benefit to them right now, it will just cause anxiety later.

Answer 9

Users don't like long info (eg. evidence of password leaks).

Something like this is good enough, password plugin, cause no-one wants to see weak on their password-meter. It's simpler then your system, your system could probably improve the visual aspect.

• For the first comment, if the website is going to be for moms and dads of 40+, they are never going to know what you mean by "cracked password". Yes, we know. But they won't, so you're information is going to be useless for x% of your customers, that ain't right :)

Answer 10

Brute-force and security is not a user's problems. It is the problem of site admins. So why do users should solve the problems of admins?

Try to limit login from same IP to 10 times and make good restore-password mechanism. So now user could use any password now and site is secured.

User want to have password which it is simple to remember. Not everyone using password-manager software.