Should "Incorrect password" message show the password requirements of the current site? [duplicate]

Question

I have a question that has been bothering me some time, let me illustrate my question with an example:

• I use multiple passwords in many applications and sometimes I forget what is the password for some site.
• At this point, I do what anyone will do in my situation, try again, and when nothing else comes to mind, reset my password.
• Multiple times I've come to find that the password requirements of the current site is different from the common ones (for example, a-z A-Z 0-9 _? and 8 length) and when I input a password that matches the requirements, I come to find that was my original password all along.

If the site had told me the password requirements I might have remembered correctly my password

So my question is, Why does no one ever show these requirements?
Is there any reason for these?

Edit1: I still don't see why showing the password requirements will be a security issue if the page I'm accessing has public registry on and I can see the requirements once I try to create an account

Edit2: yes, this question is a duplicate, It was originally posted in programmers.stackexchange.com and I didnt find a similar question

Answer 1

From a Security perspective – No. From a User Experience perspective – Yes. That’s often the problem when different goals meet in the middle, which one is most important. As this is the site of User Experience, the popular answer is to show users what the rules are. That is fine as long as your security requirements are met. They don’t have to be UPPER CASE, $ym8ols or numbers. Passwords can be strong if they are long enough. In addition, both of your goals have been met making the accounts secure and useful.

Answer 2

you should not show a message reading "incorrect password" as it gives a potential intruder knowledge that the username entered was correct.
Rather give "invalid username or password", leaving them to wonder if either or both are wrong.
Password requirements similarly should not be listed on the login page, only on the page where passwords can be set/changed. Again, a potential intruder can use those requirements to refine his algorithms for password generation.

Answer 3

Yes this is a very good idea.

As of now I have no proof through academic study or anything along those lines, however, a bit of logical deduction can help show that you will probably help a lot of people by doing this.

Some provable points:

1. Users have poor memories for passwords, especially if they use your site infrequently and the password fields are permanently obscured (there's a good argument to allow plaintext viewing of password fields that you should consider, but that's not really releavnt here).

2. Users repeatedly use the same password for lots of different accounts. This is often a short, memorable string, loved ones name, name of a pet etc. They will pick something that is easy to remember then use it again and again because they are more interested in using the service than being forced to think about security. There are numerous surveys on this.

3. If you get repeat visitors then your register page will be used once and your login page manu times per user.

This list of passwords is a great example: http://www.bbc.co.uk/news/technology-24821528 - these typical users are helping their memories, require a special char and you're going to get !'s and ?'s at the end and that's about it.

By requiring a special character, capitals, or numbers (which you also shouldn't do) you are challenging the user on the first point above, that of memory and what you will often find is that a user prepends a '1' or a '#' on the end of their commonly used password.

So based on these points we can deduce that a user landing on a page will potentially have several very similar passwords in mind: ilovemydog ilovemydog123 !ilovemydog123 - by placing a reminder on the login page, which is the password related page that is really used often, I strongly suggest that you will help your users. If you optimise something to be forgotten by a human being then you should help them with a reminder wherever possible.

(Anecdotally I have arrived at exactly the same position as the OP where such a reminder would have helped me)

Answer 4

I agree with you.

Showing just "the requirements of the password creation" while attempting to login in most cases would help users remember which type of password they used in that Login system. That would even be better to show a message before user starts to write its password (when he/she puts the cursor in the password input field) and clarify the type of password that login system is requiring from the users. In this way intruders even can't distinguish if that username exists or not.