7

Although most of the places on the internet allow users to login with their existing Google or Facebook account, there are still many places where this is not an option. In such cases, remembering passwords for multiple accounts is a difficult task. Personally, I never use a password storing application and believe many people don't use them as well. So in such cases often when logging in, when the user forgets the password, there are no hints displayed which could help them remember what that could be.

When I say hints, I dont mean personlised hints indirectly helping individuals, but I mean generalised hints to everyone.

Example:

  • The password has at least 1 special character.
  • The password is of minimum 8 characters

Wouldn't this be a good UX practice, avoiding users needing to reset their passwords to a certain extent?

Improve this question
5
  • Wouldn't it make it easier for hackers to guess the password? They can exclude all the a-z combinations if they know there's a special character in it. They can exclude every combination which is longer or shorter than 8 characters aswell. Safes a lot of time!
    – SlaKrop
    Jul 9, 2014 at 6:49
  • sorry, I meant: - The password is of minimum 8 characters - which is far less specific.
    – Vinay
    Jul 9, 2014 at 6:52
  • 4
    @Vinay I am 100% behind this idea as long as the hints you show are the same restrictions that are enforced at password creation. If a site always requires at least 1 special character, giving the hint that it does so does not affect security in any way, and helpfully reminds users of what restrictions were put on the password they are trying to remember.
    – drusepth
    Jul 9, 2014 at 13:22
  • 1
    @drusepth, thats exactly my understanding as well. Any person who is trying to hack the account can easily know the restrictions that are put for creation of the passwords and to know that he wouldnt have to create an account, just needs to start creating it and get to know the restrictions. But such hints would surely help the user remember it. A kind of Cognitive help may be :)
    – Vinay
    Jul 9, 2014 at 13:58
  • 1
    As someone who studies the usability of security mechanisms this is one of my biggest annoyances with existing password authentication. Why won't you website tell me what I'm looking for? I have tens and tens of passwords, at least help me eliminate the ones that don't fit!
    – Steve Dodier-Lazaro
    Jul 12, 2014 at 11:31

6 Answers 6

Reset to default
4

As far as website security is concerned the answer is: NO (for personalised hints)!

But as this is a UX Website, the answer from the UX point of view might be: yes, it could make things easier for some users, however instead of dropping hints it would make more sense to provide an easy and fast way to reset the password.

When you start giving hints, the user is already at a point where they don't remember the password. So they could either spend some time guessing their password based on your hints or use your reset feature to set a new password in a jiffy. As users who forget their password tend to use hard to remember passwords, you could and should add a hint giving tips how to choose a password on the page where they set a new password though.

Improve this answer
8
  • 5
    What's the reason for saying no from security perspective? The same information is usually available in signup form, so there's no reason from security perspective making it not available on another page.
    – Ivan Gammel
    Jul 9, 2014 at 9:35
  • Good point. Everyone who would want to hack your account would check the hint as one of the first steps - they might even have set up a script to make it a routine. Exposing the hint by default would actually provide an incentive to come up with a much more "secure hint". So rather than "what's the name of my daughter", users might learn that they have to use something less obvious ...and then again, they might not, and then all of a sudden anyone can be a hacker :)
    – zkwsk
    Jul 9, 2014 at 9:59
  • @IvanGammel Not sure what you mean. But anything that provides hints about user credentials is bad practice from a security perspective. a good example is to display the message "user name and/or password wrong" instead of "unknown user name". Again, of course from a security point of view, if you take this aside and see it solely from UX then no password at all might be the best option.
    – msp
    Jul 9, 2014 at 10:56
  • @funkylaundry Well yes. But having "secure hints" that nobody knows... if they're "strong" enough there would be hardly any difference to a password.
    – msp
    Jul 9, 2014 at 10:58
  • 3
    @msparer the password requirements are usually put on the signup form page, so not having them as the hints on login page does not help improving security at all. If you are talking about whether these requirements should be available to users or not, the answer is, definitely, "YES". Knowing that password contains at least 8 characters and one of them is special, does not help hacker, because brute force attack time will decrease insignificantly.
    – Ivan Gammel
    Jul 9, 2014 at 11:52
4

It is an extremely good idea to remind users of your password creation rules when they don't remember their passwords. Consider the following facts:

  • most users cope with the amount of credentials they have through password reuse and password creation systems that transform an old password into a new one (see Cormac Herley's field study on password reuse and Fahl's paper on real password data).
  • most websites impose idiotic arbitrary password creation rules that are rarely the best approach to maximising theoretical password entropy and rarely deliver up to expectations as people just create 13375p35k-type passwords based on guessable common words (see the What Would Shannon Do password strength metre and Telepathwords).
  • those rules occasionally get in the way of users' coping mechanisms and force them to adapt their passwords to the local site rules.

Now, if you remind a user of the rules then they can re-transform their usual/suspected passwords and refind their password without having to go through the hassle of password reset. This has zero impact on security. As pointed out by others, though, you should always aim to make password reset convenient and fast. This is especially true if your users typically login infrequently or if you know them to have to handle a large amount of credentials with frequent resets (as in certain security-needy corporations).

As a side note, people who care about their password database security would be well advised to start by storing passwords properly (slow hashing function + unique salt per user) as this is anyway the primary way through which passwords are leaked (because of scaling effects).

Improve this answer
2

Security notwithstanding, the answer would be yes, because security not withstanding, the best UX would be when users don't need to have a password - I'd always rather be able to get at my stuff right away without the login step and without needing to remember a password, especially one with constraints like special characters.

Once security enters into it (which it always does), the answer is probably no.

Which of these is a worse user experience?

  1. I have to remember and enter a complex password in order to log in.
  2. A malicious user logs into my account and steals my information/spends my money/harasses my contacts.

From a short-term perspective, reminders about the password are helpful, but from a long-term perspective, reducing the odds of a malicious third party getting at my things is better.

Reminders like Must contain at least 1 special character are probably fine in that they'll be on the sign-up page, so a malicious user could easily get them - putting them on the login screen doesn't reduce security. Any other kind of reminder, though, reduces security and thus (in the long run) hurts UX.

Improve this answer
1

The hints that you have offered as examples, password limitations, are the types of hints that could only help a certain type of user. Namely the type that uses the same password for every site, but changes it slightly when the restrictions require her to do so. So for this user, seeing that a Capital letter is required will be a helpful reminder to use the capitalized version of her password. For all other types of users who do not use different versions of the same password, these hints would just be unnecessary clutter. Is this how most of your users would use passwords?

Improve this answer
0

There's no mental connection between minimal password length and password that user has to remember, so the hints like that will hardly help. Instead, it's better to teach users to use strong passwords that are easy to remember during account setup. Modern recommendations to passwords usually say that it should be a sequence of words, some of which are misspelled to protect from dictionary attack. See, for example, this article on Microsoft web site: http://www.microsoft.com/en-gb/security/online-privacy/passwords-create.aspx

Such sequence may have a meaning for which user can give his own hint, e.g.:

password = 2HoursInP0lice200DollarzFine
user hint = That lovely night in New York

However, user hints of any form (same thing with security questions) are not safe from security perspective (they can be a starting point for social engineering attack), so consider using it only if you are not working with sensitive personal data.

Improve this answer
7
  • This would'nt be too different from hinting the user about the length of the password. The chances of user forgetting such kind of passwords are same. How much ever easy the password is, when there are too many such passwords to remember, its going to be more difficult. Also, lengthy passwords may add up on the typing them each time. Imagine logging into more than 5 accounts with such lengthy passwords and typing them each time. But this would count when you are using for very important accounts like bank account which handle highly sensitive data.
    – Vinay
    Jul 9, 2014 at 14:09
  • Most people choose a variation of "test", "monkey", "password" and "123456" as a password. You don't want to let them tell you the hint they used. Those people would just re-type their passwords, or a word of similar meaning. Hackers could then learn to associate hints to common passwords (w/ some NLP) as soon as they got hold of a database of passwords and hints.
    – Steve Dodier-Lazaro
    Jul 12, 2014 at 10:41
  • Besides personalised hints are very bad for any user who might be targeted (executives, sysadmins...), for instance in your example I may be able to find (through searches on OSNs, visiting other databases I've broken into, social engineering on your friends) that you're referring to an arrest and I'll add relevant words to my custom dictionary when trying to break your password (see e.g., openwall.com/john).
    – Steve Dodier-Lazaro
    Jul 12, 2014 at 10:43
  • I would never think of having a loose end password when it came to creating passwords for sites with personal and sensitive data. And I am pretty sure, no executive or sys admin would dare to have a password easily crackable by hackers. This question is about the general everyday sites that people use and not targeted towards any specific user and its definitely not about "PERSONALISED" hints to specific or individual users.
    – Vinay
    Jul 14, 2014 at 4:41
  • @Sidnioulz I already mentioned security as major concern about personalized hints in my post and recommended not to use them. I mentioned this option only to reject it as something that indeed may help the user, but also as something that is not secure enough.
    – Ivan Gammel
    Jul 16, 2014 at 9:25
0

I find very hard the chances of giving hints to remember the password only just by entering an email address. I ought to believe there'd be some privacy implication in such an implementation for the same reason it's a best practice not to specify whether the email address or password used is the wrong one and you get a vague message stating that either the email address or the password just entered could be wrong no matter whether it was just the email address wrong, the password entered or both.

At the same time I've found useful a message that I got during the "resetting the password" process after entering the new password. The message was suggesting I couldn't reset the password with one used in the past which made me leave the process of resetting it and go back to the log in area and try a password I knew I'd used in the past for that service and got that eventually right. Said that some other times a hint like that won't help much and it'll take few second just to set a new password and get going.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.