Nowadays sites have different password strategies. In example:

  • Facebook: 6 characters min, no restriction
  • Ameli.fr: 8 characters min, all should be numbers.
  • StackExchange: 8 characters min, upper case, lower case, a number or a special Char ...

Some users have several passwords, it could be:

  • For security reasons :they can use the common one for spam sites, complex one for the bank etc..
  • Historical reason : they were used to have a 6 character password, then they had to create a new one for 8 Characters with an UpperCase.

What happens when they try to connect to a website?

There are no signifiers on the password strategy used, they have to guess which password they have to use. If it's a website they don't visit often they will at a point use the forgot password link, then go to their mail client, go back to the website, save the new passwords with the displayed strategy. This is even more true with the "remember me" option which allows the user to forget his password for a period.

Then they will repeat the same workflow every month until they memorize the password strategy of the website.

I would like to do add usual password validation on the login form, to help user retrieving his matching password. It could be a discreet message like "your password has at least one upper case letter" etc, the same way than registration forms provide it. I don't see any security problem since the password strategy is directly available in the registration form.

Is this idea a good step forward, or can anyone come up with another solution?

  • What you mean to say, is for every user you will show the restrictions on the login form? If I am not mistaken, aren't you cluttering the UI for those users who use it on a regular basis? You might include something like Password hints control which will give user the restrictions for a password, but I have rarely seen that and it needs a better name than hints. – Sol Apr 15 '15 at 11:05
  • It's a UX board, but there's no security issue on that, you're not revealing any information that was not revealed before. – Grzegorz Janik Apr 15 '15 at 11:05

I think it is not a good idea, because

  1. It is uncommon to have password hints on a login. Users can misinterpret it as a register form. Login and register have huge similarity problems anyway. Password hints will increase the problem of a clear difference of both.
  2. You are not solving your root problem, which is a very unregular visit. Even with hints users may struggle to memorize their old password. May be a third party login suits better your needs, i.e. facebook, google+ or twitter login.
  3. Personally, I like it, if I can see which e-mail address is actually valid for my login. I have several. So, if no security issues forbid it, why not give a message "password for this email isn't valid" and "no user with this email address is known".
  4. Another option might be, to grant users a time-slot via the forget password link. So, they click the link, get an email with website link, go to website and are logged in instantly. Not a password reset, but entry via email.
| improve this answer | |
  • 1) good point 2) the root problem is not unregular visit, because the same problem occurs with remember me tokens. How many times do you go on Stack Overflow and how many time do you have to actually type your password? 4) i don't see the point 3) Let's say the adress is valid, and you have an explisive message, you still don't know what is the password matching the unknow password strategy – goto Apr 15 '15 at 14:43
  • @goto 4)It is a variant of the forget password process, but without reseting the password. Usually you get an email with a temporary login-key for re-setting your password. Give them just the temporary login-key and let them not re-set their password! 3)Sure, otherwise you don't know if your password or/and the mail address is the incorrect part. Giving hints which one is valid reduces the login effort. – FrankL Apr 16 '15 at 7:33

I think its a great idea! Ceres why

As Jakob Nielsen says you want Users to Recognize rather than Recall. 10 usability heuristics for UI design Why make users recall their password rules if you can give them a clue?

If you want to sort of have the best of both worlds you can wait until they get it wrong the first time then give them a hint about the rules there. Or even better if the password doesnt conform to the rules say Hey we require a special symbol for example password isnt valid where password% is valid.

I am also a fan of showing them a valid password and an invalid password.

Lastly the 3-5 attempts and locking them out is a bit dated because rarely are they broken via brute force. I would allow 5 attempts then make them wait a minute then after 7 attempts increase the time.

Lastly having incredibly complex password rules and frequent required changes may seem more secure but these complex rules encourage people to write their passwords on sticky notes and put them near their desk.

| improve this answer | |

You are correct, you can freely show the hint since the attackers will already know it. From this article -

What's more, like the other two crackers profiled in this article, radix didn't know where the password list was taken from, eliminating one of the key techniques crackers use when deciphering leaked hashes. "If I knew the site, I would go there and find out what the requirements are," he said. The information would have allowed radix to craft custom rule sets targeted at the specific hashes he was trying to crack.

Help your users remember what they had to enter because the attackers definitely remember.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.