There have been a couple of questions about enforcing good passwords, so I thought I'd add my own:
In addition to enforcing a minimum Shannon entropy, would it generally be a good practice to prohibit the use of specific passwords or elements outright, based on criteria such as:
- Appeared at least once on SplashData's "Top 25" list ("password", "letmein", "qwerty")
- Publicly famous proper name ("parishilton", "hasselhoff")
- "Interesting" in the field of IT security ("correcthorsebatterystaple", "orpheanbeholderscrydoubt")
- Any password previously used in our system and known to have been compromised
These are obviously all really bad choices for passwords, and yet at least the first category is bad because they're so commonly used. The lesson is obvious; don't let your users use these bad passwords.
It would be trivial to take a submitted password, strip spaces and convert all letters to lowercase, and then run a "contains" comparison with the blacklist items, subverting attempts to add entropy using spaces, capitalization, or adding additional letters/numbers. It would be a little harder, not impossible, to detect letter substitutions (perhaps a minimum Levenshtein distance). It would also be easy to store the reason why the entry is banned, and return it to the user, encouraging them to try something substantially different and hopefully more unpredictable (though such a specific reason for rejection could provide too much information if the "user" is an attacker).
Good in theory? What problems might you foresee in practice?