13

I have frequently bumped into this issue: sites ask for my password (e.g. Stack Exchange itself) when I want to do something like updating my profile.
This is per se a low priority site for me so I use my weakest password in mind that fits the minimum requirements. The event (profile update) is also rare so I forget my password completely.
I then face the issue of not being able to login then go to the password reset screen where the criteria are written black and white. After that I return to the login screen and enter the correct password.

The question is not whether or not I am a moron but why the criteria are not shown when I mess up my password for the first time.

An example to weakest password:

  1. Anything is permitted: dodge
  2. Uppercase and lowercase needed: Dodge
  3. At least 8 characters and uppercase: Dodgerman
  4. At least 8 + uppercase & number needed: Dodge1014
Improve this question
3
  • Personal tip: Have a standard password that fulfills the criteria of all sites (e.g. "%Dodge1bullet") and modify it for each site (e.g. "stack%Dodge1bullet" for SE). Your password will be unique/safe(r), always work and easy to remember.
    – Josef Engelfrost
    Mar 24, 2015 at 20:09
  • 2
    If for some reason I knew your password to stack exchange was "stack%Dodge1bullet" how hard is it for me to guess your password to Facebook?
    – Steve Bennett
    Mar 25, 2015 at 2:25
  • The only downside I can see is that sometimes password requirements change, so you should keep all the requirements (present and past) stored and show the right one to the right user
    – alca
    May 6, 2015 at 15:32

2 Answers 2

Reset to default
10

You are different from most users

You aren't a moron at all. You are using the minimum password requirement as a mnemonic to remember the password. People use all kind of mnemonic techniques to remember passwords.

Unfortunately, that's not what the minimum password rules were designed for (eg what happens if a site decides to upgrade it's password policy).

So for the majority of users who utilize completely different techniques to remember passwords, displaying the minimum requirements on a login form would be unnecessary clutter, and it would actually worsen the login experience because of the additional cognitive load incurred while visually scanning the requirement text.

UX designers make tradeoffs all the time to design simple, clear workflows for users. In this case, the tradeoff is between providing (1) a simple login form which works for the majority of users and (2) a form which restates "out of workflow" minimum requirements which might be used as a mnemonic by some users. The first approach is definitely the correct UX decision.

Improve this answer
5
  • I like your answer but still, when I mess up my password for the first time refers to the popup/plain text in red letting me know that I messed up. For people who happen to know their passwords this would not be a bother. Other mnemonic types probably don't get their flashbacks from the "Password incorrect" text.
    – sicarius92
    Mar 22, 2015 at 18:23
  • 1
    @sicarius92 from a design perspective, when a user mis-enters a password the most likely causes are 1. typos and 2. forgetting. So the pop-up messages are usually designed to aid that process. For #2, designers generally offer password recovery or reminder options. Since password rules are not used as mnemonics often, unfortunately they are not displayed to avoid confusion and cognitive load
    – tohster
    Mar 22, 2015 at 18:32
  • Yours is an educated answer addressing my question, I think that's the most I can get. Thank you! P.S. I still think fundamentally wrong passwords should be differentiated from e.g. typos.
    – sicarius92
    Mar 22, 2015 at 21:40
  • Can you point to any research (or have you seen this yourself) supporting that most users use different techniques to remember/create passwords? I'm in the same boat as sicarius92 and am always frustrated by this issue. If it is true that most people (90%? 51%?) use other techniques for remembering passwords I'm keen to see the research.
    – Drew Beck
    Mar 23, 2015 at 6:19
  • 1
    Drew, yes this is pretty well documented. Off the top of my head, one well known example was an analysis of the leaked Sony passwords a couple years back. A good amateur analysis is here: troyhunt.com/2011/07/science-of-password-selection.html?m=1
    – tohster
    Mar 23, 2015 at 6:36
1

EDIT: I agree with your point. It won't protect hackers.

I discussed with some of my UX friends. The possible thing would be that since a normal user already knows the criteria it doesn't have to be there.

But still, you can give an info icon, which on hovering will display the password criteria.

And like the other user said, you think different!!

====================================================================== Previous Answer: Answer is simple. Security!!

The login page is for logging in only with sure credentials. In simple words you have the key to a lock(login page).

It's not like you have a bunch of keys and try to pick it. (i.e) what hackers try to do.

In fact even the forget password page should not provide the password rules which will become easy for hackers to work on their codes to hack.

The rules for the password should be provided only in 2 instances.

  1. Creating the password during sign-up
  2. Resetting the password.
Improve this answer
1
  • 2
    Those pages are easily available to potential hackers, I don't get your point. Hackers will have the rules set and direct passwords to the service provider until it gives authentication. With proper security even those who know the rules will be turned from trying to brute force hack an account.
    – sicarius92
    Mar 22, 2015 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.