8

I've been using zxcvbn to enforce strong passwords for a service where break-ins would cause considerable problems. However, the service is only viable if many users sign up. We've found that users are inclined to walk away in frustration when zxcvbn rejects password after password (based on both website metrics and in-person events). We started with zxcvbn's strength at 4 and have since reduced it to 2, but the problem persists.

It's become painfully clear that your average Jane is used to creating bad passwords and has no interest in being retrained. We don't have the budget to take on responsibility for that kind of social change, and the powers that be are pushing hard to go back to something like "8 characters, at least one number, etc." It's understandable from the business perspective - we spend more time coaching users through the password creation process than we do talking about our service.

So, what's the next best way to enforce a password policy that doesn't leave us with a slew of easily hacked user accounts while at the same time not alienating a non-technical user base?

Edit: Logins happen though web interface as well as others such as IMAP which makes anything other than password-only logins unlikely to be viable.

Improve this question
1
  • So, this is an IMAP and HTTP service? What other methods do you need to support?
    – Alex Holst
    Mar 18, 2016 at 15:33

2 Answers 2

Reset to default
4

Do you have the option of adding 2-Factor authentication to your site? Here's the first article that came up when I googled "using google authenticator on your site".

If this is a corporate network and your users are your employees, then you have the option of using physical tokens like smartcards plugged into their desktops, or grid cards.

From a social engineering / design perspective, can you find a way to use a carrot approach rather than a whip approach? By that I mean give perks to users who have strong passwords (in a way that's not visible to other users, otherwise it's equivalent to public shaming for weak passwords which is actually worse). Maybe a small discount on membership fees or purchases, or in-service perks like small vanity features, more storage, priority queuing, wtv. I know MMOs have used this to great effect to help encourage the adoption of 2-Factor keys and strong passwords.

Improve this answer
6
  • Thank you, but no, TFA is not an option and we are dealing with users who are not employees, not required to use our service in any way. Appreciate the response/ideas though!
    – myday
    Mar 17, 2016 at 17:29
  • ... Gmail offers TFA, I am neither a Gmail employee, nor am I required to use the service. Same is true for the video games I play. I don't see why that would stop you from offering an app-based, or SMS-based TFA.
    – Mike Ounsworth
    Mar 17, 2016 at 17:33
  • Right, thanks for the encouragement. TFA is great, but can't be used at all of our access points. Still, it may be worthwhile to use it where we can. I will advocate for this, but still want to hear other ideas. Thanks!
    – myday
    Mar 17, 2016 at 18:36
  • What about the "incentives for users with strong passwords" part of my answer?
    – Mike Ounsworth
    Mar 17, 2016 at 18:38
  • 2
    I like the incentives idea. One possible incentive - even if it is still a bit of a stick - is to use stricter rate-limiting or failed password lockout processes for weaker passwords. It's defensible in terms of threat modelling even if it sounds a bit punitive. Shorter expiry periods for weaker passwords has less basis in a threat model but will allow you to wear down the resistance of persistent selectors of weak passwords.
    – Bell
    Mar 19, 2016 at 20:11
1

I assume this is a web-based service. (I am not familiar with zxcvbn).

One option would be to do away with user-visible passwords entirely. If you can get users to sign up using their email address, you email them a link with a unique id. When they click that link, a strong cookie is set in their browser.

'Password resets' consists of emailing them a new link.

Improve this answer
2
  • Sorry, I edited my question to note that it's not a web-only service
    – myday
    Mar 17, 2016 at 19:24
  • So a user will need to "reset their password" if they ever use a different browser or clear their history? May not be ideal, especially when dealing with lower tech users.
    – kirkpatt
    Jul 26, 2016 at 20:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .