I am developing a file sharing and hosting service, and right now I don't have any requirements set other then that a password has to be at least 6 characters long. I also accept all characters.
I'm thinking that it should be possible for users to have the freedom of creating their own passwords, whether weak or strong. However if that is a bad thing to allow, I don't know.
I'm not sure if I should add a not so strict requirement that rejects the most obvious bad passwords like:
- ' '
Giving the users that much freedom with their password is a really good thing when it comes to UX. But the strength will be compromised with a large portion of users who use a weak password. Dropbox also uses this approach. And I don't think a strength meter is of use when it's actually not enforced.
Is this considered good practice or should I do it differently?
Note: I will also have server security measurements that go against brute force attacks.
As Question Overflow said in the comments:
There are just too many obviously bad passwords to make it a practical thing to implement and it might annoy your users who just want to sign up quickly.
And I agree with that, so I don't think I will be implementing the not so strict requirement what I considered above.