Nowadays sites have different password strategies. In example:
- Facebook: 6 characters min, no restriction
- Ameli.fr: 8 characters min, all should be numbers.
- StackExchange: 8 characters min, upper case, lower case, a number or a special Char ...
Some users have several passwords, it could be:
- For security reasons :they can use the common one for spam sites, complex one for the bank etc..
- Historical reason : they were used to have a 6 character password, then they had to create a new one for 8 Characters with an UpperCase.
What happens when they try to connect to a website?
There are no signifiers on the password strategy used, they have to guess which password they have to use. If it's a website they don't visit often they will at a point use the forgot password link, then go to their mail client, go back to the website, save the new passwords with the displayed strategy. This is even more true with the "remember me" option which allows the user to forget his password for a period.
Then they will repeat the same workflow every month until they memorize the password strategy of the website.
I would like to do add usual password validation on the login form, to help user retrieving his matching password. It could be a discreet message like "your password has at least one upper case letter" etc, the same way than registration forms provide it. I don't see any security problem since the password strategy is directly available in the registration form.
Is this idea a good step forward, or can anyone come up with another solution?