Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

Please Note: I am not going to name the websites which have these horrible standards for their clients and users.


I have had to change my passwords for my routine update just recently in the last few months, several of my major services that I use forces weaker password standards. These weaker standards, which all of my passwords has to have, is special symbols (!@#$%^&*) and other special requirements.

A few of the major issues which came up with my password using their standards of a password is as following:

  • Must not start with a number
  • Must not have a special character
  • Must be a max of 8 to 12 characters long (depending on the service)

Why would they promote weaker passwords with these requirements?

I thought that passwords were suppose to (currently) be as long as we want, have special characters, and who cares if it starts with a number, etc, etc, etc.


Update 1

I may have forgotten details of what is going on, but I can provide some more information on the issues that I am seeing seeing here.

One of these services is my banking company and the other is my cellphone service provider. I am stuck with these two services given where I live. These services are widely used, so they should be able to afford high-quality security.

share|improve this question

marked as duplicate by D.W., Xander, TildalWave, Mark, Traven Jul 30 at 0:52

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

6  
"These two services allows me live. Also, these two services that I am stuck with rules my area and where I live. They make billions off of all of us easily." So the Mafia has finally discovered the merits of eBusiness? –  Philipp Jul 29 at 20:52
4  
What research have you done? I expect you to do a significant amount of research before asking. There's lots on this site that addresses these topics. For instance, this looks like a duplicate of security.stackexchange.com/q/33470/971. See also security.stackexchange.com/q/57909/971 and security.stackexchange.com/q/16455/971 and security.stackexchange.com/q/16196/971. Next time, I suggest doing more research -- it will help you ask a more targeted question. Also, I suggest you avoid ranting in the question. –  D.W. Jul 29 at 21:36
    
What do you mean by "These two services allows me live."? –  D.W. Jul 29 at 21:37
1  
@D.W. To be fair, I think that most of those questions actually ask something quite different (they are about 'good' requirements or special corner cases (the q/z question)). only the first one covers parts of this question (restricted password length). But I did a search now myself and was also able to find this question dealing with special characters. –  tim Jul 29 at 22:42
1  
@tim, did you read the first link I suggested as a duplicate? Its title is "What technical reasons are there to have low maximum password lengths?", which is exactly one of the cases mentioned in the question (it's not about requirements for good passwords, and it's not about a corner case). Your link is a good find, too. So, between security.stackexchange.com/q/33470/971 and security.stackexchange.com/q/17192/971, I think this question is pretty well answered by answers already available on this site. –  D.W. Jul 29 at 23:32

3 Answers 3

up vote 12 down vote accepted

If you use the same password for several distinct sites, then you are doing something wrong. Each password shall be site-specific. Therefore, there shall be no reason why the "weaker standards" would have any impact on "all your passwords".

(Similarly, there is no rational reason for changing all your passwords on a regular basis. There is a widespread custom of frequent password renewal, but it is a "common practice", certainly not a "best practice".)


If you have site-specific passwords, then poorly designed requirements will impact that site only. Ultimately, each site maintains its own security, and their "password requirements" are part of it. If a site enforces a maximum password size of 8 characters, then this means that:

  • The site owner does not have a good grasp of security.
  • The site is most probably weak in many ways; the weird password requirements are, usually, only the tip of the iceberg.

Thus, concentrating on the password misses the point. That site's security stinks and you can do nothing about it, except isolating the troublesome site, which is done by not reusing passwords.

share|improve this answer
    
Very good answer. I like it. The part that is truly troublesome is that two of these sites own the market and make billions off of us. –  Traven Jul 29 at 19:21
1  
You forgot the option of just switching to a different provider for the services offered by the site. Not always an option, certainly, but one that should at least be considered where possible. –  Iszi Jul 29 at 20:17

One reason for enforcing weaker passwords is that a weaker password is easier to remember for the user. When the user forgets their password, an automatic password retrieval procedure must be used. Such a procedure usually entails that a plaintext password is sent to an email account. This offers a lot of attack surface which is outside of the control of the website. The less often users forget their passwords, the less often do they need to initiate this procedure.

On the other hand, the attack scenarios where password strength matters, like brute-forcing their login form or stealing their database, are in their control. They can take measures to prevent these.

When people need to choose between the risk they can control and the risk they can't, they tend to pick the first.

share|improve this answer
    
How often legitimate users initiate the password reset procedure has little impact on overall security. What really matters is how often attackers initiate the password reset procedure. An attacker can initiate the password reset procedure, even if the user has not forgotten their password. –  kasperd Jul 29 at 21:36

Explanations for weak password rules

Well, those are obviously bad rules. But here are some possible explanations (or "explanations") for it:

Must not start with a number

The site owner might actually think that this is a good rule. To prevent for example 1234546 or just prepending a common phrase with '1' (e.g. 1password)

Must not have a special character

The owner might be afraid that their system (form, encryption algorithm, ...) cannot handle special characters or that these are a security risk.

Must be a max of 8 to 12 characters long (depending on the service)

Some encryption algorithms truncate the password after 8 characters. This does not mean that a password cannot be longer, but the owner might think this. They might also be afraid that a user enters a ridiculously long password, which they might fear could break their system.

Again, these are not good reasons, but reasons someone might have.

Regarding your Update: Why not change these rules?

Also, these two services that I am stuck with rules my area and where I live.

and:

With all of that money, resources, and some of the IT employees in the industry, they should be up on standards

It does not sound that they have much of an incentive to change. Losing customers seems unlikely if it is an important service that only two companies supply. Depending on the country, it's probably save to wait for a lawsuit (which might not even come) and (in case it is even won) pay some small-ish amount of money.

And changing a big system is not as easy as it sounds. If it is an old system (which it very well might be), it could be possible that it actually cannot handle special characters (especially not all utf8 characters). Why change it when it works right now? (is what they are probably thinking - if this is even a problem they are aware of).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.