Allowing every password of 6+ characters. Good practice?

Question

I am developing a file sharing and hosting service, and right now I don't have any requirements set other then that a password has to be at least 6 characters long. I also accept all characters.

I'm thinking that it should be possible for users to have the freedom of creating their own passwords, whether weak or strong. However if that is a bad thing to allow, I don't know.

I'm not sure if I should add a not so strict requirement that rejects the most obvious bad passwords like:

• '      '
• '123456'
• '!@#$%^'
• 'password'

Giving the users that much freedom with their password is a really good thing when it comes to UX. But the strength will be compromised with a large portion of users who use a weak password. Dropbox also uses this approach. And I don't think a strength meter is of use when it's actually not enforced.

Is this considered good practice or should I do it differently?

Note: I will also have server security measurements that go against brute force attacks.

EDIT

As Question Overflow said in the comments:

There are just too many obviously bad passwords to make it a practical thing to implement and it might annoy your users who just want to sign up quickly.

And I agree with that, so I don't think I will be implementing the not so strict requirement what I considered above.

Answer 1

I'm pretty sure you have seen this:

Source: http://xkcd.com/936/

In other words: Length alone can be good enough as security requirement.

Answer 2

This is a little bit of a self-plug, but at the same time, this is a piece of user-experience that I care a lot about.

Taking the XKCD approach, we need to reward users for using complex passwords, and educate them to use more complex passwords. When I talk about complexity, I specifically mean the computational complexity behind attacking it, so "correcthorsebatterystaple" is more complex than "Tr0ub4dor&3".

Ultimately we're trying to protect users passwords from being cracked should the password hash database be used, and so along with the normal hashing+salting considerations, we should also be enforcing complex passwords in terms of computation, not in terms of human-intuitive complexity.

I developed a jQuery plugin, Complexify that does this. The basic idea is to look at the character sets that would be required to brute-force the password, and look at the sizes of them, calculating the number of possible passwords over the length of the password being tested. This means that "Tr0ub4dor&3" scores 40%, and fails the check, but "correcthorsebatterystaple" scores 68% and passes. For scoring, the 100% mark is placed at approximately a 28 character password containing uppercase, lowercase, punctuation and numbers.

By showing a 'progress bar' to the user that updates on every key press, they can see what effect different characters have on their password, and see that most of the complexity comes from extending the length of their password.

I would recommend this approach. While my original is a jQuery plugin, there's also now a Node.js version and an Objective-C version. It's a relatively simple piece of code, so shouldn't take more than an hour to implement in most other languages if those aren't appropriate.

Answer 3

I wearied of the memory burden of passwords for everything and started using a password locker (KeyPassX in particular (not great but sufficient)).

Because I use its random password generation feature, I have quite literally never seen nor typed many of the passwords that I use.

The UX problem that I now bump into is "you didn't follow our arbitrary rules for strength and therefore we reject your password". The "8–15 character" limit is the one that is the most irritating because it forces me to use a shorter password than I prefer.

So please don't restrict my password. You can't guess my security concerns, and if I want to use password your site can't teach me better practices. The best it will teach me that I have to use a hard to remember password, so I'll write it down or forget it. If I forget it, I may not come back to your site out of frustration.

As with every security concern, you have to determine what threat you are protecting against.

Answer 4

In my opinion, it would be a good way to do because although it lets a lot of freedom to your users, it won't expose them to the attacks that are using the most frequent and obvious passwords.

You could also try to detect passwords like dates of birth, phone numbers etc... but for these sort of passwords, you should simply display a warning (because sometimes, even if it's not a very good password, your users might choose an other one that might be even worse if you constrain them too much.