Forcing users to use a particular pattern for passwords

Question

Many websites, specially government ones, enforce users to use a password which conforms to particular criteria. For example: use between 8-13 characters with at-least one integer and one capital letter and sometimes a special character. I have found such password patterns are rather hard to follow, and if you do it becomes extremely difficult to remember.

My Question is: Considering the security aspects vs memorizing burden to remember a unique password pattern for a site, it is worth to enforce password pattern restrictions upon user?

Answer 1

Every constraint you add to a password pattern, the more cognitive load you add to a user. And constrains can be good to make a password secure. But how secure is a password that user constantly forget and as a consequence hit the “forgot password” workflow yet again. Further you minimize the option for users to use there already memorized secure password on this site as well. Something that at least 60% of users do.

Security issues are particularly difficult to deal with because they’re an annoyance. We just want to let people get at the great tool we’ve created, but instead we have to build barriers between the user and the application. Users must prove their identities. We can’t trust any data they provide unless it’s been thoroughly sanitized.

Unfortunately, this is reality. A great deal of web traffic really is malicious, and sensitive data gets stolen. Typically, we ask users to supply a username (often an e-mail address) along with a password to sign in to an application. The username identifies the person, while the password proves that the person submitting the username is indeed the one who created the account. That’s the theory, based on two assumptions:

1. A password will never be visible outside the mind of the person who created it.

2. Both the username and password can be recalled from memory when needed.

Reference: The problem with passwords

So what do you do?

Try to find the most common password around making users chose their own familiar password. You need (1) a minimum length of eight characters, (2) upper case and lower case letter, (3) a number or a special character like !@#£¤$. This pattern is fairly secure, but is questioned among security experts and usability experts. If you don’t trust my pattern make the judgment on the scale of User Experience vs. Security and you’ll be fine.

But never ever do this:

Answer 2

You shouldn't enforce the characters in passwords. Instead you should encourage passphrases which although longer are more secure and easier to remember.

Instead of trying to explain this, I will let XKCD do it for me:

Answer 3

Like you say password pattern enforcement is basically a good way to make sure that the user is going to invent a password that is optimised to be forgotten. This is especially true of rules that are quite complicated (one I recently came across demanded that the password have at least one capital letter, one digit, one special character, be at least 8 characters long, not have any double letter combinations ...).

The aim is to increase security and I have worked in places where people write the passwords down on paper and leave it next to the workstation because they can't remember them. Is that secure? I don't think so. I think the user should be able to do what they want and should be "guided" into making a good choice.

A popular mechanism is to have a strength or goodness indicator next to the password field where a check is made to determine the relative password strength. This gives the user some direction and advice on their password choice. A common implementation of this has the coloured box ranging from red (bad) to green (good, strong).

Another solution is to use OpenID providers like Google and the stackexchange sites. That way the user doesn't have to remember anything and it's usually one-click login.

In the context of usability and UX both of these methods are better than password pattern enforcement.

Oh, and while we are talking about passwords; whatever you do, don't ever truncate the user's password to 8 characters. It's unbelievable that there are sites that do this, even when the password field accepts more than 8 characters, and then expect their users to be able to log in.

Answer 4

Interesting question. Though I agree that requiring the user to create fairly complex passwords could cause difficulty in them remembering it, you also have to realize that people given a chance will create really weak passwords (which are easily remember-able but also can be cracked with a brute force or dictionary attack). To quote this article :

If you let them, users will choose the simplest and easiest to remember password they can. This will often be their name (perhaps backwards), username, date of birth, email address, website name, something out of the dictionary, or even “password.” Analysis of leaked Hotmail and MySpace passwords show this to be true. As was the case In just about every case, websites should prevent users from selecting these types of passwords as they are the first targets for attackers.

That said, an alternative option is to provide a hint box next to the login page which would inform the users about the expected layout of the password

E.g. Your password must be 8-13 characters long and must contain at least one character in upper case and one special Charecter

I had posted a similar question about this here which might be worth looking at.

This would inform the users about what kind of passwords they used and give them a starting point towards entering the correct password. Further more studies have shown that about 60 % of users use the same password across multiple sites and hence having a common point to start with with regards to the password structure will help them remember the password better

Answer 5

Any discussion of security needs to introduce the concept of risk assessment. Can an attacker destroy your website or app if they get a user's password? Can an attacker get free stuff if they get a user's password? Can an attacker get access to user money if they get a password?

I guess I'm appealing to the concept of "form follows function" - for bank accounts we need strong security. Unfortunately, this means strong passphrases (rarely implemented) or strong passwords. And a strong password should have a mix of upper and lower case, numbers, and symbols, and be longer than X characters, and never be re-used on different websites and etc etc.

These passwords are very hard to use. They're hard to use for people with no impairment on a real computer. Imagine how hard they are for people with dyslexia or a learning disability or only one arm or for people using touch screen keyboards.

One work-around: suggest your users get a password safe; ask them to use a very strong pass phrase for that safe and ask them to use the safe to generate shorter strong passwords. Give links to sources of software and information, including but not limited to Lastpass, Keepass, Password Safe, 1password and Diceware.

Answer 6

What I would do is to propose a password to the user. He doesn't need to accept it. The proposed password is a random string of two or three short phrases stitched together. The phrases are not real words, but are similar to them, so the user can easily remember the password. Usually a "verb" and a "noun" For example (taking from xkcd): corekthorcebateristapli

Of course, a large-ish dictionary should be assembled first, maybe with frequency of usage of each word, to avoid over-using...