10

If you try creating an account using your smartphone, these platforms don't seem to have strong password requirements. They both enforce a minimum 6 character limit and nothing else (I did however notice Twitter seems to filter out certain passwords like 111111 whereas this is a legitimate password on Facebook).

I can understand that enforcing strict rules such as uppercase, lowercase, number, and symbol can frustrate users and make passwords less memorable. However, I'm not convinced how the current password validation (or lack thereof) is a better choice.

Why do these apps not enforce the aforementioned guidelines? If I'm creating a new app now, how should I approach this problem?

closed as primarily opinion-based by Steffen Ullrich, forest, AndrolGenhald, Xander, Teun Vink Nov 7 '18 at 7:14

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

6

Facebook and Twitter have very...specific, controversial security postures. They serve a broad market and the security space does not always appreciate everything they do. My recommendation for an app you're building might be not to follow Facebook and Twitter's examples in terms of security.

For resources, I recommend looking to OWASP first. If you're not familiar with OWASP, they're a collection of application security methods and best practices, giving visibility on the whole lifecycle - from conception and design through to pentesting. They lead the appsec industry and speak with a huge amount of (well-earned) authority.

All that being said, definitely checkout OWASP's information on password strength controls. If you're looking for help with password strength implementation, hopefully that should sort you out. (And while you're there, have a look at the OWASP top 10 for other helpful tips when it comes to building your app.)

Great question by the way. Good luck with the app!

  • 25
    Can you tell us more about their very specific, controversial security postures? – Michael Hampton Nov 4 '18 at 19:24
  • Absolutely. One comment isn't quite enough to be comprehensive, but the gist of it is that these (and similar) companies are quite secure in some regards, insecure in others, and generally may or may not take best practices into account. In particular, Facebook's posture is complex to say the least. – securityOrange Nov 5 '18 at 1:03
  • 1
    For a more comprehensive answer, I'd direct you to Zuckerberg's Senate hearings. Or, if not to the hearings, then I'd point you to Facebook's recent breach of 50 million accounts. Or, if not that breach, then I'd point you to the fact that Pew found 67% of all tweeted links to be from bots. – securityOrange Nov 5 '18 at 1:15
  • @MichaelHampton Hope this helped, and let me know if you have any other questions. I wish there was more room for longer answers - it's an interesting, rabbit hole-y topic. – securityOrange Nov 5 '18 at 1:16
  • 3
    You've got plenty of room for it! Your answer is only 4% of the maximum length... It's better to edit your answer anyway, as comments are only temporary. – Michael Hampton Nov 5 '18 at 1:59

Not the answer you're looking for? Browse other questions tagged or ask your own question.