8

Are there any guidelines on the play-off between forcing users to have complex passwords (longer, including numbers and special characters etc) - and the reduction in security if users therefore have to write down these passwords because they can't remember them ?

To clarify: what I'm thinking about here is where users may have their own preferred (and memorised) set of passwords, but get forced by sites to start making them longer; or adding a number, or sites which just refuse to accept the password unless the site itself deems it strong enough ( hello Google ). So users then have to think of other passwords that fit these particular criteria - which being non standard ones they are then more likely to write down.

So I guess the question is what do users actually do when confronted with a site which tries to force them to use passwords with particular formatting.

Improve this question
3
  • 1
    The article is related to your question. Consider the idea: "You don’t need to remember 100 passwords if you have 1 rule set for generating them" (from the article)
    – Alexey Kolchenko
    Jul 2, 2014 at 12:53
  • 1
    Please also look at similar questions here on ux, you will get some other relevant info :-)
    – Toni Leigh
    Jul 2, 2014 at 19:17
  • To add one more interesting thing. If attacker goes to your site and they see "must start with a letter, then there need to be 3 numbers...", that makes it a lot easier, they can filter trying passwords that are always invalid on your site. You put more work on everyone to save time for attacker. Just don't. Let it be anything.
    – Sahsahae
    Nov 25, 2019 at 14:17

5 Answers 5

Reset to default
12

This xkcd comic illustrates quite nicely that the only thing you should worry about is the length of the password:

enter image description here

This quote brings it to the point:

Through 20 years of effort, we’ve successfully trained everyone to use passwords that are hard for humans to remember, but easy for computers to guess.

You should therefore take special care that passwords aren't restricted in length (I've come across quite a few websites where the maximum length was 8 characters!).

Forcing users to do anything is rarely a good idea. It might be better to allow all passwords, but display a "Password strength" value as direct feedback after they enter the password. You could calculate this strength based on length and/or special characters. The value could be represented by a colour, e.g. red for weak, orange for strong and green for very strong.

Personally, I don't like it when websites force me to choose a password that consists of various components (numbers, different cases, special characters). Most of the time these are the exact websites that receive a "Password reset request" the next time I visit them.

Improve this answer
6
  • I go with this bit as the question answer "Forcing users to do anything is rarely a good idea. It might be better to allow all passwords, but display a "Password strength" value as direct feedback after they enter the password"
    – PhillipW
    Jul 4, 2014 at 10:27
  • 2
    While this answer and the answer from Code Maverick are both great, there is one thing to note: When a password is 'cracked' it's generally not just brute forced. The biggest danger is from a DB leak, in this case there are several techniques undesirables use to get to your password, many of which rely not on your password strength but the strength of the sites hashing/salting/encryption. Some crackers can reveal 80%+ of the passwords on the entire database in just a few hours using lists and filters which include common words, prefixes, substitutions, numbers etc.
    – bendataclear
    Jul 7, 2014 at 15:04
  • 1
    That's of course true. The 80%+ you said are on unsalted passwords I suppose? Hashing without salting makes it a lot easier for crackers with a database dump. However how to store your passwords and protect them against crackers is a bit out of the scope of this question :)
    – msp
    Jul 8, 2014 at 8:15
  • 1
    Beware that "correcthorsebattery" is quite easily brute forcible for a computer. Because computers do not have to guess one character at a time they can use a dictionary attack. While it looks long "correcthorsebattery" becomes equivalent to 28 bit entropy as those are common words that computer will start the dictionary attack with. This password checker cygnius.net/snippets/passtest.html is one of few that models a dictionary attack. By comparison "correcthorseba3ttery" will take centuries to crack
    – Jason A.
    Nov 27, 2014 at 11:22
  • 1
    While your point concerning dictionary attacks is valid, "correcthorsebatterystaple" would need over 60 years to crack (using the link you've mentioned). Before adding numbers instead of letters, the easier protection would be to begin each of the four words with a capital letter. This way it'll also take centuries but would still be easy to remember
    – msp
    Nov 27, 2014 at 12:09
4

If it's not a site I care about, I leave.

If not, and I have to enter a complex password instead of a more secure password, one that's based purely on length, I use KeyPass:

enter image description here


Just for information's sake, https://howsecureismypassword.net/ is the place to go to understand why

Length > Complexity


Length

Here is how long it would take to crack 00000000000000000000:

enter image description here


Complexity

Here is how long it would take to crack A1b2c#d$:

enter image description here

Improve this answer
1
  • 2
    Upvote based on example password crack times and link to password strength test site. Worth reminding people: Never use an existing password on password test sites.
    – Bernhard Hofmann
    Jul 3, 2014 at 10:18
1

Rather than Showing them Password Strength.

Show them in this way.

For low password strength-----"Anyone can steal and guess your password"

For medium password strength----"Brilliant people like James bond can guess and steal it easily".

For Strong password ----- "Even god can't guess or steal .Good job"...Something like that :)

Improve this answer
1

This is an interesting question, @msp's answer is a good elaboration and I would have posted something similar but I then looked literally at the question and thought:

"What are most sites doing by forcing you to have things like 1 number, one capital etc"?

When you think about it like that the site is likely trying to avoid you unintentionally using a password like "password" by making it more "complex" by putting in "Password1!".

In a lot of ways this is great, you're now more secure...assuming your start point was terrible. If however you have chosen "correcthorsebatterystaple" and are then forced to add "1!" or similar then I can see why the OP is asking for guidelines about whether enforcing such policies is positive or negative.

I then tried to think from a few perspectives. If me an experienced user of computers tried to use the site in question with what I felt was a secure password and was then asked to amend it for that specific site, I would be annoyed, probably use a default "1!" or similar if I felt the site was worth it, then likely get locked out a few times when using the site as I wouldn't remember the change I'd made. This is exacerbated if I ever had to reset my password and was forced "not to use the same password as before", then I'd end up with "2@" or something and forget that next time round.

However, if I was my parents and I'd originally used the password of "myname" then being forced to use "MyName123!" would possibly make things more secure, but the annoyance and issue above still exists.

When you boil it down, is a site responsible for the strength of your password? if so, as @msp mentions, length should be the criteria and likely nothing else.

Recently I also believe the status quo is that having to change your password every X days is deemed less secure (based on the increased likelihood of people writing things down) than allowing a password to stick. This puts the emphasis on the user which, frankly is where things should sit.

Improve this answer
0

Give a visual cue to inspire them to create unusual phrases, e.g., bunny on the dashboard. It might also help users create a visual image of the phrase in their minds.

enter image description here

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.