2

After getting locked out of my account for typing in my password incorrectly several times in a row, I realized that the password I chose is too prone to typos and has resulted in locked accounts.

It occurred to me that ergonomics could be part of a password strength meter. Either through ergonomic analysis or through having the user confirm the password in three or four fields on user sign-up forms.

Are there best practices for mitigating lock-outs due to user password typos?

  • 1
    Step 1: Require increasingly complex passwords. Step 2: Force user to enter complex password more times than is necessary. Step 3: Yell at user for choosing a complex password. Step 4: Profit! – Nathan Rabe Aug 14 '14 at 20:46
  • 4
    Serious comment: Any determination of ergonomics would have to take the user's language and keyboard layout into account. – Nathan Rabe Aug 14 '14 at 20:48
  • That would be a daunting undertaking. I suppose I'll use your first comment to create a wonderful ergonomic password generator app. Ca-Ching! – TK-421 Aug 15 '14 at 11:54
  • This type of ergonomic "helper" won't strengthen the password, it would actually weaken it. – Adnan Khan Aug 15 '14 at 13:46
  • users don't like entering the same data twice. Any one slightly skilled with a computer just cuts-and-pastes into each field anyways, therefor bypassing the purpose of asking multiple times. You could block pasting, but now you're just annoying those skilled users. – DA01 Aug 15 '14 at 15:38
4

Oh dear. Don't ever, and I mean ever, create barriers for users when signing up. Having the user confirm the password several times (even more than once), is a barrier which will affect sign up rates.

There are actually a lot of ways you can fix the signup and login process such as:

mockup

download bmml source – Wireframes created with Balsamiq Mockups

You could have a checkbox (or icon) to reveal the password where the user can confirm what he/she wrote was correct. This solution also works really well in the signup process because it's less form fields.

The less form fields in a sign up process the better. This is because signing up for an account is a painful process. Adding countless fields and pages to make the process longer is just irritating and will drastically reduce the conversion rates.

  • That's a clever solution as well. Too bad I've only ever seen this on Mobile sign-ups. – Pdxd Aug 15 '14 at 13:03
  • I'm a huge fan of this because again, in this case, less is more :) – Majo0od Aug 15 '14 at 13:07
2

The only example I see commonly is an indication that caps lock is on.

Example

As the combination of letters, numbers, and various symbols can vary greatly, this seems to be one of the only common errors I know of aside from producing password hints and an easy Password reset process.

having the user confirm the password in three or four fields on user sign-up forms

Might this type of repetition would irritate users? Personally, I would just type my password onto Notepad, then Paste it in for all the boxes if I saw that - but that's just me.

0

How many times would mean several though? If it means 4 or 5 times, that shouldn't make you lock out your users, unless for example you are an online banking portal with a very low password complexity requirement. The justification for locking out accounts is to prevent brute force techniques, not slippery fingers. I feel ergonomics will limit complexity and make it easier to guess passwords...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.