What is the best (or good) practise to deal with users, who are determined to reuse their old password, whether it be good or bad? Or simply use a bad password?
A user wants to create an account on our website. We have some criteria such as length and special characters. The user then enters their usual password, which we look up on https://haveibeenpwned.com/Passwords to see if it has been in any breaches. In this case, the user's password has been leaked in the past.
At this point, we have a couple of options:
- Tell the user in a friendly way, that their password is insecure, because it has been leaked before
- Tell them 1. and tell them they can't use that password, because it could put their account at risk
- Tell them 1. but allow them to use it, if they check a checkbox saying "I am aware that I am using a password that has been leaked"
Obviously, the best possible thing is to not let them use that password, however, some users might not tolerate that. I certainly wouldn't, but it completely depends on the case. Option 3 is interesting, because if they get hacked and sue us for allowing them to use a bad password, they can always claim they didn't see the checkbox.
Have there been any papers on this, with any kind of proof, that proves that one method is better than the other? Any statistics on the matter?
I know Microsoft enforces the good old "we noticed you tried to change password to a previous password you had". Certainly some thoughts must've went through their minds, if they disallow users to use old passwords.