0

It's frustrating how some websites require symbols while some don't allow them, some require a capital or number while others don't, some don't allow the same consecutive characters, etc.

Every once in a while I'll have to go through the password retrieval process just because the website has some obscure password policy.

Is there a standard we could be using?

Improve this question
9
  • 3
    Obligatory: xkcd.com/936
    – Nathron
    Mar 30, 2015 at 0:29
  • 4
    I was sure it was going to be this one... xkcd.com/927
    – Bowen
    Mar 30, 2015 at 5:48
  • I just want to use a password I can remember or we should move beyond passwords
    – Paul van den Dool
    Mar 30, 2015 at 9:42
  • 1
    There's not really a standard as such, because things change too quickly; the best you can expect is guidelines on how to help users pick a password which is difficult to crack using current cracking techniques and hardware. It's a difficult (technical) field where it's easy to be wrong, including by being out of date.
    – Vince Bowdren
    Mar 30, 2015 at 14:38
  • 1
    @vincebowdren Actually preventing a brute force attack is not at all up to the user. A user should make a password that's not easy to guess, but the system should be preventing brute force attacks (eg, flagging or blocking accounts that have high numbers of failed attempts, having an escalating delay when responding after failed password attempts, using multi-factor authentication, etc). Likewise, the system should be storing the password in a way that's not easy to crack if the database is compromised -- again, not a user issue.
    – gregmac
    Mar 30, 2015 at 18:09

3 Answers 3

Reset to default
2

Password policies are usually a bad thing. They can be so diverse they introduce the following issues:

  1. They make it harder for you to remember a password, e.g. when wrong password was used, you'll think "did I use a special character here?"
  2. They make it difficult to use a standard password generation recipe when using password managers, because requirements will vary

Unfortunately a standard for password policies does not exist. There's too much of a conflict of opinions, security requirements, organizational security policies, software limitations, security education for users and security education for website system administrators.

Improve this answer
1

I've asked this related question before:

Forcing Users To think up More Complex Passwords / Ease of Remembering Them

*And I agree that the move from letting you use your own existing passwords to ones which where a bit longer and now a move again to have to have capital letters and numbers in just makes life more complicated, particularly with the tediousness of not knowing whether you'd actually pressed the shift key down enough to get that capital letter - when all you can see is **********.*

Improve this answer
1

It's unlikely that there will ever be an enforced standard

A simple tradeoff illustrates why:

  • There is a tradeoff between how secure a password is, and how easy it is to memorize and use. See this article for example.

  • Different applications can have vastly different security needs. An account used to comment on a blog is very different from an account used to manage your life savings. While designers for a financial institution may like a long, high-entropy password, the designers for a blog may hate the idea because unnecessarily harsh password policies may cause users to abandon account creation.

There have been policy and academic debates over password standardization (e.g. this paper) but it's unlikely that this will be solved without addressing the fundamental usability tradeoff above.

Current thinking is to move away from passwords (which are shockingly insecure) towards two-factor authentication for applications that need extra security.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.