12

I regularly find myself trying to login to websites where I don't remember the password I use. I make some guesses as to what I might have used but usually wind up having to reset it.

One thing that would make the process easier for me would be if the sites reminded me of what the password requirements were. (i.e. if I knew the password needed to be 8 characters, with a capital letter and a number, I wouldn't guess anything that didn't meet those requirements.)

But it seems so obvious to me, so there must be some reason why sites don't do this - is there any security risk to doing this?

0

2 Answers 2

11

If someone wants to crack the passwords for some of your site's users, then knowing the password rules may help him reduce his list of "potential passwords" by pruning out the passwords that the server would not have accepted in the first place. However, if:

  • the attacker can also register as a user (as is the case for many Web sites, where account creation is free);
  • the "registration page" already lists the password requirements;

then the attacker can be assumed to already have that information. Hence, it does not harm security to recall them on the login page.

Anyway, maintaining password requirements secret would be difficult, since they have been shown to all users. A secret which is shared by more than 3 or 4 persons is no longer a secret. So it can be assumed that the attacker already knows your password requirements, and displaying them on the login page gives him no extra advantage.

There is a risk that displaying the password requirements on the login page may confuse some users, because such requirements are usually displayed on registration pages, not login pages. You will have to be careful in your wording and presentation. Another possible usability issue is if you change the password requirements at some point, for new passwords: some old, but still valid passwords may fail to match the new requirements, and, there again, the corresponding users may be confused by the mismatch. Yet, these are not security issues (except that confused users are, generally speaking, a potential security hazard).

3
  • Good point, I didn't consider changing password requirements.
    – DHall
    Jan 17, 2012 at 14:34
  • 2
    +1 for "be careful in your wording and presentation". I've seen so many helpdesk tickets because people don't know what "non alpha-numeric" means. The response is always "use a symbol".
    – Ladadadada
    Jan 17, 2012 at 14:38
  • 1
    Most websites I have this issue with aren't a problem because of password requirements - they're password limitations. Unfortunately, this is rarely if ever disclosed as you suggest.
    – Iszi
    Jan 17, 2012 at 20:30
2

For any sensible set of "minimum" password requirements, no.

For example, if the minimum requirement is 8 alphanumeric characters, and the maximum length accepted is 12 alphanumeric characters, then knowing the constraints reduces the search space from 36^12 to (36^12-36^8), which is a reduction of 0.00005% (1 / 36^4 = 1 in 1.7 million). The reduction will be even smaller if the maximum length is larger than 12.

Similarly, knowing the that the password must have at least one "non-alpha" character reduces the search space only by an insignificant amount.

For "must be within" (maximum length, allowable characters) requirements it may reduce the search space noticably. But a sensible password system should allow at least 16 alphanumeric characters, and ideally 32 or more (to allow passphrases to be used), which is enough to make brute forcing infeasible.

And, as Tom's answer notes, the attacker will discover the constraints soon enough if they are able to create their own login/change their own password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .