4

Some systems have complex password requirements. Because of this, it may be difficult to remember the password with a particular system. I understand that there may be security reasons for wanting to hide the requirements, but since that information is already available if the user registers, why not make it available on the log-in screen?

Is there any research that indicates it is detrimental to the user experience to provide the password requirements at the log-in screen? Why is this practice not implemented regularly?

I am not suggesting that the requirements always be displayed, but perhaps it may make sense to provide the requirements after a failed log-in, especially if the attempted password doesn't meet the requirements!

For those who want background:

My friend has a website she accesses once a month at most. The password requirements there are strictest I have seen. Every time she uses the site, she inevitably locks herself out and must reset her password. In general, the passwords she attempts do not fit the password restriction rules.

Improve this question
4
  • Erm, that links to this question?
    – Koen Lageveen
    May 21, 2013 at 17:31
  • @KoenLageveen Lol Oops, here's the correct link to the Related Question: Would it be bad design to put password guidelines next to a login box?
    – Daniel
    May 21, 2013 at 17:33
  • 2
    In what sense does the linked question not answer your question? It's selected answer is helpful enough. If you're looking for why nobody does that, I'd say it's because services with draconian password rules obviously don't care about UX, don't care about people actually using the service, but do care about security (but are going about it wrong).
    – Koen Lageveen
    May 21, 2013 at 17:39
  • Obligatory link whenever someone thinks they are improving security by imposing all sorts of rules on password composition: Password strength
    – Marjan Venema
    May 21, 2013 at 19:22

2 Answers 2

Reset to default
1

I totally agree that if you are not a frequent user of the site, then it's likely that the user forgets the password. Encouraging password security is not something everyone does so users get used to this simple passwords (or one simple unique password across all of their accounts).

Time has changed but not all sites have realized the importance of this and that causes that users get used to this low level secure passwords.

The best practice for users is to have a password management program or have a standard password that fulfills the requirements of secure passwords (length, uppercase, number, etc). However, you are right, most users don't have this program (or probably don't even know about it).

The solution to show an alert once the user has failed to put in the password is good(either next to the form or as a js alert) saying "please remember that you need x letters, number,etc)' - Some could say that this could lower the security of the site by giving away hints but some others would say that the password "formula" is in the registration form and is no secret.

Improve this answer
0

Some softwares with very strong security work like this : 1 you enter your email and some informations about you, the first time 2 an administrator checks your identity and validate it 3 you receive an email with a link to confirm your identity

Since here nothing really different from almost website

But after, the next follow times : 1 you go to the login page 2 you enter your email 3 the system generate a password like an OTP (On Time Password) 4 the system sends you the code by mail 5 you enter the code and your email on the login page.

Some time it sends it not by email but by sms.

I recognise it is strong and strict but I think it is better for the user, he hasn't to remember the password when he uses the system rarely.

I use a system like this rarely and i don't ask myself to remember the password.

The problem of such a way, it is when you use the system everyday, you have to get the password in your mail.

Perhaps in this case you can offer the two options at the first connection : "personal password for frequently connections" or "new password each connection" for rarely connections and the possibility to change it after.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.