My website has always used case insensitive passwords for millions of users. The security specialist is pushing us to change to case sensitive passwords. Are there any studies or best practices on this? How will the users re-act if all of a sudden we are requiring case sensitivity on a password they made 3 years ago?
1
-
3Facebook has an interesting solution to the capslock issue with cases; they store two hashes of your password; one in the case you enter, one in reversed case, so you can get in with a capslocked password. Here's a post on IT Security about that Of course it won't solve other caps related issues. Security-wise I'd definitely recommend case sensitivity, you vastly increase potential entropy.– ZeldaCommented Oct 30, 2012 at 15:42
Add a comment
|
3 Answers
First of all, you should make small research - How many your users use password with incorrect case sensitivity? It will show how many users will be affected by your changes and help you to choose good type of communication.
I haven't read any study about Case sensitive vs case insensitive passwords, but from UX point of view, it's better to use case-insensitive passwords. One of the Nielsen heuristics is Error prevention:
Even better than good error messages is a careful design which prevents a problem from occurring in the first place. Either eliminate error-prone conditions or check for them and present users with confirmation option before they commit to the action.
Maybe, it will be good idea to follow Facebook best practices and accept three forms of user password:
- Original password
- Original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.
- Your original password with the case reversed, for those with a caps lock key on.
answered Oct 30, 2012 at 14:59
-
6I really, really hope that you can't actually test that. It means that you are storing the password in plain text, which is bad security policy.– AndréCommented Oct 30, 2012 at 15:02
-
2@André, oh c'mon, you can do it even if the passwords are stored in hash - you just need to save entered password hash in database near username (or another primary key) if user have been successfully logged and at the end of research write one query to get result. This is possible because we don't need password, only to compare to hash and get TRUE/FALSE statement. Commented Oct 30, 2012 at 15:21
-
I quite positive Nielsen was not talking about tampering with user authentication and promoting compromising of user integrity when he was discussing error prevention. I agree that the Facebook strategy is quite justifiable, but I feel that dumbing down the authenticity procedure even more by allowing anything as long as it's the correct characters in the correct order is not the way to go. Commented Oct 30, 2012 at 15:27
-
Your #2 comment is very important as you noted with mobile as it will often auto capitalize the first letter. That said as a developer you can add the
autocapitalize="off"flag to help tell mobile browsers to not mess with the value entered. Commented Oct 30, 2012 at 21:05 -
@AndroidHustle, thank you for your opinion, but I disagree with you. Entering case sensitive password is error-prone condition and case insensitive passwords helps us to prevent error ;) Commented Nov 18, 2012 at 21:29
It all depends on how you will introduce it.
When you do this shift make sure you communicate it to the user the next time they log in, that you have a new security strategy and would appreciate if the user could specify a new password.
You should not simply introduce this new password strategy and not explain this to your existing users, that would most probably be confusing for a considerable part of your users who hasn't kept track of their password constitution.
Using case sensitive passwords is the absolute norm, so that should not be confusing. However you have to make sure that you also communicate this so that there are no misunderstandings once the shift is introduced.
answered Oct 30, 2012 at 14:39
Case sensitive passwords are harder(takes longer) to crack, also introducing numbers and !"£$%^&*()_+ signs would increase the security level:
If you want to keep the old users without applying this new change you could allow them to log in without it, based on username.
And all new users that register should use case sensitive passwords, should put a little note when the user is registering that the password is case sensitive.
Another way is to ask the old users update their passwords when they will try to log in after this change, allow them to enter their old password and then redirect them to a forgot password page or create new password page of course have an explanation that due to security update(make it sound positive) the passwords now are case sensitive.
-
2The hashes you show show nothing about the security. Requiring capitals and/or 'special' characters actually decreases strength, as you give away details on the password to the potiential crackers. Also, please allow spaces in passwords: it makes it possible to use a pass phrase instead.– AndréCommented Oct 30, 2012 at 15:01
-
@André thx for feedback, got rid of hashes :) I didn't say they should display the rules of the password. They should allow new users to register using anything they want.– Igor-GCommented Oct 30, 2012 at 15:14
-
why force users to make a new password? I would say 99% won't be affected by this change. If they made "Password" as their password, chances are they are typing in "Password" to log in.– surprCommented Oct 30, 2012 at 15:27
-
@surpr didn't say you should force users to do anything. Allow the new system to check for case sensitive passwords for new users, and leave the old users as they are, or allow them to change the password... Don't need to specify what password users should use/create, could add the "weak-strong" password process bar like on ebay register page. This approach, as studies shown, encourages users to create harder passwords(Web Form Design: Filling in the Blanks).– Igor-GCommented Oct 30, 2012 at 16:37