If you are a user and your company implements a password policy that says your password must have at least 8 characters, at least 1 number, at least one alphabet and at least 1 special character, would it be too complex for you as a user to create such a password? I am currently tasked to come up with a complexity policy and was met with objection on the special character part. How hard is it for a normal user to use just at least 1 special character in their password? I mean, is it that hard and would counter productive? Can you share your experiences?

closed as primarily opinion-based by Neil Smithline, Deer Hunter, schroeder Dec 25 '15 at 21:06

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    While I think the question is interesting, I'm thinking that asking people to share experiences may be too opinion-based. – Neil Smithline Dec 24 '15 at 1:25
  • 2
    I agree, but according to security.stackexchange.com/help/dont-ask, it really isn't allowed. – Neil Smithline Dec 24 '15 at 1:48
  • 4
    We have that rule for a long time, and 99% of the users just add an Exclamation mark or something to the end of their password, so it gives less additional security than enforcing another letter. It's a pretty silly rule, I think. – Aganju Dec 24 '15 at 1:54
  • 3
    I send people to reddit.com/r/security, but things are pretty wild over there. You may get no useful opinions or lots of great data. And don't give up here yet. Perhaps you'll get some good answers even if the question gets closed. – Neil Smithline Dec 24 '15 at 1:56
  • 1
    I can say that a policy like that is the kind that leads to poor passwords. You should build a policy that attempts to guess password entropy rather than character variation. For example, a 24 digit random number is about 80-bits of entropy, which is very secure for a password, but would be rejected by a poor policy – Richie Frame Dec 24 '15 at 1:59

What's far more critical than a diversity of non-alphanumeric symbols is simple password length. Specialized cracking machines* have existed for years that are capable of brute force attacking every combination of letters, numbers, and symbols, up to 10 characters long (given a sufficiently motivated attacker who is willing to spend thousands of dollars on a password cracking computer, of course.) In this environment, quibbling about an exclamation point in an 8 character password is fruitless. Require passwords to be at least 12 or more characters, and you'll have a much more secure solution. If it makes you more comfortable, you can require a digit or upper case character, too. Another mitigation is to use PBKDF2 to store passwords, rendering parallel crackers less efficient.

There are already many questions and answers in security.SE about recommended password policies, you should have a look at those.

* It's an ordinary PC filled with GPU cards and a massively parallel CUDA program to compute SHA-1 hashes; the last time I looked it could compute 348 billion SHA-1 hashes per second. I doubt hardware has gotten slower over time.

  • Thanks for your reply. Interesting. So I can simply say, at least 12 characters. Don't even have to mention any special character requirements or numbers and it would be more secure than one having just length of 8 characters with special characters..But let's say I use a 12 character word in a dictionary. Isn't this susceptible to dictionary attack still? except it may not take longer, but it's crackable? – Pang Ser Lark Dec 24 '15 at 2:15
  • 1
    Yes, any dictionary word will still fall very quickly, regardless of length. Adding digits, symbols, and/or upper/lower case requirements will help. I've seen rules of 'Your password must be at least 12 characters long and include at least three of the following types of characters: upper case letters, lower case letters, numbers, and symbols.' Most people can understand those restrictions. – John Deters Dec 24 '15 at 2:35
  • 1
    It may also help to refer to it as a "pass phrase". This jogs people into thinking of a sequence of words, which can help a bit. Of course, if this makes all your users think of movie quotes, it won't help much; I have already heard of at least one password cracker that scrapes the IMDB database. Live "entropy checkers", like KeePass has, are probably the best approach. Set the threshold to require 64 bits and you'll probably never have to worry about the policy again. – John Deters Dec 24 '15 at 2:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.