5

For a secure application, we push users to use passphrases instead of passwords. We've got some explanations in the password change page. For the field, we use the label "passphrase" to push again the user to use some.

One user wondered if people will get confused about what the “passphrase” might be.

Are those concerns real, should we really switch back to "password", or is "passphrase" a better option to help people change their habits?

EDIT: Maybe I've not been clear enough in my question. The question is about the labeling. We will use passphrases and OWASP rules in any cases. The question is "do we display 'password' for the field, or 'passphrase'?". Or "Will the user be confused to read 'username/passphrase' instead of 'username/password' on the login page?"

Improve this question
4
  • 1
    Do you have any formatting requirements to enforce a passphrase, or are you just trying to encourage it's use?
    – James Jenkins
    Commented Jun 18, 2013 at 9:54
  • 1
    Requirements are minimum 10 characters and at least 3 of the following rules: 1) at least one lowercase char 2) at least one upercase char 3) at least one number 4) at least one symbol (space is concidered as symbol) (It's OWASP recommandations)
    – cporte
    Commented Jun 18, 2013 at 10:04
  • 1
    Use "passphrase". Add a nice little blurb to the right on why they would want the security that passphrases provide, and other security tips. Ask xkcd's permission to display the "correct horse battery staple" cartoon, but disallow this passphrase.
    – Deer Hunter
    Commented Jun 19, 2013 at 6:45
  • cporte - done...
    – Deer Hunter
    Commented Jun 19, 2013 at 7:37

4 Answers 4

Reset to default
3

A recipe:

  • Use "passphrase". (why? - you are promoting the best practice, you may actually want to include a link to OWASP)

  • Add a nice little blurb to the right on why they would want the security that passphrases provide, and other security tips.

  • Use xkcd's "correct horse battery staple" cartoon, but disallow this passphrase.

correct horse battery staple

Rubber-hose security

Note: XKCD cartoons are licensed under a Creative Commons Attribution-NonCommercial 2.5 License.

Improve this answer
0

If seen from user's perspective, then the option of password should be chosen. This is because the user may get confuse between password and pass-phrase. Also he may find it tedious to generate or remember it.

Generating pass-phrase is also a difficult task.

To keep the simplicity in using the system, the option of password is more correct.

Improve this answer
2
  • Thanks, but not using passphrases is not an option for us :). I edited the question to be clearer.
    – cporte
    Commented Jun 18, 2013 at 10:45
  • Ok Then you may use passphrase in the place of password. Just make sure to specify in short about what a passphrase is, to avoid the confusion of the user. I think this may answer your question.
    – Kedar Tiwaskar
    Commented Jun 18, 2013 at 10:59
0

One way to encourage users to really try and make their password/passphrase more secure is to add an element of gamification into the mix.

If you next to the input fields display a status bar/rank indicator/etc that dynamically rises as the input gets more complex, that can work as an enticement for the user to try and make the password as secure as possible.

The use of phrases rather than character/number combinations is still quite unusual though. So I would suggest that you cap the security ranking on say 3/4 and adjacent to the indicator prompts the user to separate the password with spaces to make the password even more secure.

enter image description here

enter image description here

Improve this answer
3
  • Thanks for your great answer! But it not answer my more specific question. I edited the question to be clearer.
    – cporte
    Commented Jun 18, 2013 at 10:46
  • Oh dear, are we really going to continue, even promote, a practice that is better changed just because passphrases are still quite unusual?
    – Marjan Venema
    Commented Jun 18, 2013 at 16:27
  • @MarjanVenema Well, this illustrates the point though, the second one is the first one broken up as four separate words. So, yea... =)
    – AndroidHustle
    Commented Jun 18, 2013 at 17:52
0

I think I would tend to present the passphrase as a password because average users are not familiar with the passphrase concept. Then, you could clarify in your requirements that the "password" can have or must have a space. I haven't tried that but I would think it is easier to understand.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.