My website has always used case insensitive passwords for millions of users. The security specialist is pushing us to change to case sensitive passwords. Are there any studies or best practices on this? How will the users re-act if all of a sudden we are requiring case sensitivity on a password they made 3 years ago?
First of all, you should make small research - How many your users use password with incorrect case sensitivity? It will show how many users will be affected by your changes and help you to choose good type of communication.
I haven't read any study about Case sensitive vs case insensitive passwords, but from UX point of view, it's better to use case-insensitive passwords. One of the Nielsen heuristics is Error prevention:
Even better than good error messages is a careful design which prevents a problem from occurring in the first place. Either eliminate error-prone conditions or check for them and present users with confirmation option before they commit to the action.
Maybe, it will be good idea to follow Facebook best practices and accept three forms of user password:
- Original password
- Original password with the first letter capitalized. This is only for mobile devices, which sometimes capitalize the first character of a word.
- Your original password with the case reversed, for those with a caps lock key on.
It all depends on how you will introduce it.
When you do this shift make sure you communicate it to the user the next time they log in, that you have a new security strategy and would appreciate if the user could specify a new password.
You should not simply introduce this new password strategy and not explain this to your existing users, that would most probably be confusing for a considerable part of your users who hasn't kept track of their password constitution.
Using case sensitive passwords is the absolute norm, so that should not be confusing. However you have to make sure that you also communicate this so that there are no misunderstandings once the shift is introduced.
Case sensitive passwords are harder(takes longer) to crack, also introducing numbers and !"£$%^&*()_+ signs would increase the security level:
If you want to keep the old users without applying this new change you could allow them to log in without it, based on username.
And all new users that register should use case sensitive passwords, should put a little note when the user is registering that the password is case sensitive.
Another way is to ask the old users update their passwords when they will try to log in after this change, allow them to enter their old password and then redirect them to a forgot password page or create new password page of course have an explanation that due to security update(make it sound positive) the passwords now are case sensitive.