Is it a security risk to remind users of the password requirements at login?

Question

I regularly find myself trying to login to websites where I don't remember the password I use. I make some guesses as to what I might have used but usually wind up having to reset it.

One thing that would make the process easier for me would be if the sites reminded me of what the password requirements were. (i.e. if I knew the password needed to be 8 characters, with a capital letter and a number, I wouldn't guess anything that didn't meet those requirements.)

But it seems so obvious to me, so there must be some reason why sites don't do this - is there any security risk to doing this?

Answer 1

If someone wants to crack the passwords for some of your site's users, then knowing the password rules may help him reduce his list of "potential passwords" by pruning out the passwords that the server would not have accepted in the first place. However, if:

• the attacker can also register as a user (as is the case for many Web sites, where account creation is free);
• the "registration page" already lists the password requirements;

then the attacker can be assumed to already have that information. Hence, it does not harm security to recall them on the login page.

Anyway, maintaining password requirements secret would be difficult, since they have been shown to all users. A secret which is shared by more than 3 or 4 persons is no longer a secret. So it can be assumed that the attacker already knows your password requirements, and displaying them on the login page gives him no extra advantage.

There is a risk that displaying the password requirements on the login page may confuse some users, because such requirements are usually displayed on registration pages, not login pages. You will have to be careful in your wording and presentation. Another possible usability issue is if you change the password requirements at some point, for new passwords: some old, but still valid passwords may fail to match the new requirements, and, there again, the corresponding users may be confused by the mismatch. Yet, these are not security issues (except that confused users are, generally speaking, a potential security hazard).

Answer 2

For any sensible set of "minimum" password requirements, no.

For example, if the minimum requirement is 8 alphanumeric characters, and the maximum length accepted is 12 alphanumeric characters, then knowing the constraints reduces the search space from 36^12 to (36^12-36^8), which is a reduction of 0.00005% (1 / 36^4 = 1 in 1.7 million). The reduction will be even smaller if the maximum length is larger than 12.

Similarly, knowing the that the password must have at least one "non-alpha" character reduces the search space only by an insignificant amount.

For "must be within" (maximum length, allowable characters) requirements it may reduce the search space noticably. But a sensible password system should allow at least 16 alphanumeric characters, and ideally 32 or more (to allow passphrases to be used), which is enough to make brute forcing infeasible.

And, as Tom's answer notes, the attacker will discover the constraints soon enough if they are able to create their own login/change their own password.