0

I am devising a set of password requirements. I am requiring users to use the following:

  • Minimum 8 characters
  • Minimum 1 number
  • Minimum 1 special character
  • Minimum 1 letter (any case)

I would like to replace "Minimum 1 letter (any case)" with "Minimum 1 Uppercase letter".

Would this increase or decrease the security of my user's passwords?

On one hand, I think it would increase the chance that users use a password with a mix of UC and LC. On the other hand, does spelling it out in the password requirements help someone trying to brute force? For instance, if I asked for ONLY uppercase, then it would indicate to an attacker that they only need to try for uppercase.

I understand there are better ways to go about this all, and doing a "pick 3 of 4" would be good, but this is my current situation given working with business-side.

Improve this question
3
  • If you require an uppercase character, 99% of people who don't already have an uppercase character in their password will simply capitalize the first character. You'll end up with "Password1!" instead of "password1!".
    – AndrolGenhald
    Oct 24, 2018 at 14:48
  • Would that increase the chances for a brute force/guess? I get that it's predictable in a sense but I guess I am interested to know what it does for an attacker.
    – USAtodayILL
    Oct 24, 2018 at 14:52
  • 4
    I believe the correct answer here is "You're asking the wrong question"; password complexity rules like this are going out of style. See NIST SP800-63b section 5.1 Memorized Secrets for a modern take on guiding users to choose strong passwords.
    – Mike Ounsworth
    Oct 24, 2018 at 15:21

3 Answers 3

Reset to default
8

The effect of a password policy depends on how both users and attackers respond to it. Unfortunately, you can count on your users being lazy and your attackers being creative.

In general, adding more restrictions to passwords has the following effect:

  • The effective entropy of a good (that is, random) password decreases a little since all forbidden passwords are removed from the attackers search space.
  • The lazy user might gain a little bit (after all, Password1! is better than password). On the other hand, the burden of complying with all the rules might provoke the user to give up and go with a terrible password that passes the test just to get the god damn form to submit.

In the end, this is an empirical question about user behaviour and not a mathematical about entropy calculations. I'd say that both of your alternatives are about equally bad, but that is just a guess. Fortunately, there are better alternatives:

  • Drop all conditions (except the lenght one) and instead blacklist leaked passwords.
  • Consider easing on the other rules and increase the minimum length instead, to 10 or perhaps 12.
Improve this answer
1
  • 2
    +t For identifying this as a human behavior problem, not a math problem. Mathematically oriented people are slowly figuring out that the rest of the population is never going to operate like perfect rational computing devices, and more importantly this is an important point.
    – Steve Sether
    Oct 24, 2018 at 16:09
4

There have been many discussions about password-policies, whenever a question like this comes up, I always post the obligatory XKCD first: https://xkcd.com/936/

But to answer your question: It depends.

If you want to prevent users from using dictionary words, you could go with any of the rules you proposed. But I prefer to hint the users with a text like: "Do not use existing words as your password" in the password form.

When you want to prevent people from re-using their passwords: I'd suggest adding a hint to the password form. "Never choose a password you use somewhere else" instead of trying to come up with some combination of rules that is not used anywhere else.

Finally, when you are trying to 'increase' a password's 'security' against brute force cracking: length is the only thing that really matters. In fact: with a set of password composition rules, the cracker can even exclude a big portion of combinations, so you are only making the password weaker from that perspective.

I would like to replace "Minimum 1 letter (any case)" with "Minimum 1 Uppercase letter".

This would make a dictionary attack slightly more difficult, but 99% of people will uppercase the first letter, and a good cracker tool uses that in their advantage.

Again: there are many discussions about the subject, these are just my 2 cents. I hate it when I am forced to have my password manager make some stupid exception to comply with a elaborate set of requirements.

Instead of bikeshedding over the requirements, just make sure that the passwords are stored securely. Use a strong hash and salt.

Improve this answer
6
  • 2
    +1 though I disagree with "length is the only thing that really matters." For example, 32t72n* is stronger than password even though it's shorter. What really matters is how frequently your password appears in cracked password lists.
    – Mike Ounsworth
    Oct 24, 2018 at 15:17
  • 1
    "When you are trying to 'increase' a password's 'security' against brute force cracking" that is true for pure dumb brute force, but the fact is real attackers don't use pure dumb brute force.
    – Peter Green
    Oct 24, 2018 at 15:22
  • 1
    To clarify: length is the only weapon against brute force attacks where the attacker tries every combination of characters. The attacker usually performs a dictionary attack first as they are cheaper to perform. So yes, a word like password is easier to crack than a random combination of characters, but if the password is not a real word and has to be brute forced, length is your only friend.
    – user189659
    Oct 24, 2018 at 15:26
  • 1
    Perhaps you should re-work your answer to focus on dictionary attacks, and only mention pure brute-force / length as a side-note?
    – Mike Ounsworth
    Oct 24, 2018 at 15:29
  • Reworked the answer as per comment of Mike, thanks Mike! :)
    – user189659
    Oct 24, 2018 at 15:39
0

Truthfully I doubt it makes much difference either way. With your original rule set most users won't capitalise at all. With your modified rule set most users will capitalise the first letter.

That is the problem with password rules. Users will do the bare minimum to comply with them. So they end up adding much less entropy than you would nievely expect.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .