I was reading about UX and passwords to try to decide on explaining the requirements (ex: 1 capital letter, 1 number, 1 special character,eight characters) and came across this answer which sent me down a bit of a rabbit hole.
I understand how passphrases might be easier to use than passwords. Mobile users won't have to switch keyboards. I can see how it might be easier to remember like the cartoon suggests. From what I can understand, after reading some posts and articles it is actually more secure which is good, of course. I'd like to encourage our users to create more secure passwords and hopefully help them develop good habits for other sites they visit. I went to read the OWASP recommendations based off of this answer but it actually has the typical requirements listed. Perhaps I'm looking at the wrong but I don't understand why it tells the OP to link to the OWASP when it's actually reinforcing the traditional guidelines.
Plus, I haven't found anywhere that actually use passphrases in all my time as a person who logs into sites. Or I haven't come across a site that asks for longer passphrases (Any examples out there I could see?) I suspect for the most part it's the user who chooses to do this. But most sites have informed users that the special characters and numbers are stronger so (again, I'm assuming, bad) I doubt many people do it. Should I just let them create a password and encourage them to create a passphrase? Again, this accepted answer says no. So lets say that I don't.
Going this route also makes them think about passwords in an entirely new way. They're accustomed to dealing with the typical password generation process used to meet all of a website's password requirements. Especially if they're allowed to reuse the same password across multiple sites. Which, we know that's not good, but they like that. So while that's kind of frustrating, it's also expected and not much of a surprise. That has to speak to usability to some degree, right?
This post is now kind of a two-parter:
1) I'm trying to figure out the best way to implement this so I can decide if I want to make the push for it or not. I have worked it out a bit in the wireframe below. The user clicks 'what's this' and then it shows the pop up to teach them. They click the learn more and get the details on the increased security benefits and ease of use (since we think it's easier to remember). I thought I was going to send them to the OWASP site, but now I'm not so sure. I don't really want to show a cartoon because it's a cartoon and this site is not that kind of site. I'd also keep the user from using my example passphrases. If I give the user the guidelines for passphrases on the login screen like I do on the sign up screen I think that'd help with the usability. This post gave me that idea. The wording in the pop up will change. This post also gives some feedback into how to educate the user.
Also, look at all that text surrounding that passphrase input field. It's crazy. But if I'm going to try to teach them and make it easy to use, then isn't all of that necessary? Do I need to confirm a passphrase if I give them the ability to show it instead of masking it?
Can I make the process better?
2) Passphrases are so different I'm having a hard time actually convincing myself to use it.
This question kind of broaches this subject but it's more on labelling and not really on the usability of the idea itself. The accepted answer does have ideas on how to educate users about passphrases which help for the first half of my question, but I'm still wondering about the usability of this technique.
Has anyone tested the usability of passphrases over passwords? Has anyone out there implemented it? How successful has it been?
The last thing I want to do is implement something like this based off of four posts I found and then discover it's too frustrating. I'll do some wireframe testing of my own but if I can get some feedback before making the argument for this approach it'd be helpful. I think it's going to raise some eyebrows.
Basically, I'm confused. And I'm a UX team of one. StackExchange is about the only place I have to throw a question like this. This may be too broad to live here. You guys just let me know.