Is there an accepted standard for passwords?

Question

It's frustrating how some websites require symbols while some don't allow them, some require a capital or number while others don't, some don't allow the same consecutive characters, etc.

Every once in a while I'll have to go through the password retrieval process just because the website has some obscure password policy.

Is there a standard we could be using?

Answer 1

Password policies are usually a bad thing. They can be so diverse they introduce the following issues:

1. They make it harder for you to remember a password, e.g. when wrong password was used, you'll think "did I use a special character here?"
2. They make it difficult to use a standard password generation recipe when using password managers, because requirements will vary

Unfortunately a standard for password policies does not exist. There's too much of a conflict of opinions, security requirements, organizational security policies, software limitations, security education for users and security education for website system administrators.

Answer 2

I've asked this related question before:

Forcing Users To think up More Complex Passwords / Ease of Remembering Them

*And I agree that the move from letting you use your own existing passwords to ones which where a bit longer and now a move again to have to have capital letters and numbers in just makes life more complicated, particularly with the tediousness of not knowing whether you'd actually pressed the shift key down enough to get that capital letter - when all you can see is **********.*

Answer 3

It's unlikely that there will ever be an enforced standard

A simple tradeoff illustrates why:

• There is a tradeoff between how secure a password is, and how easy it is to memorize and use. See this article for example.

• Different applications can have vastly different security needs. An account used to comment on a blog is very different from an account used to manage your life savings. While designers for a financial institution may like a long, high-entropy password, the designers for a blog may hate the idea because unnecessarily harsh password policies may cause users to abandon account creation.

There have been policy and academic debates over password standardization (e.g. this paper) but it's unlikely that this will be solved without addressing the fundamental usability tradeoff above.

Current thinking is to move away from passwords (which are shockingly insecure) towards two-factor authentication for applications that need extra security.