Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm looking for a definitive guide to the rules that determine a "strong" password for website authentication. It seems many websites have many different rules, and I'm not sure what is the best option for creating strong, but still easy to remember passwords.

share|improve this question
add comment

1 Answer

See this.

Important points:

  • You cannot test for password strength, on looking at the password alone. Password strength is a property of how the password is generated, which you cannot measure or even estimate more or less approximately by just looking at the password ("password meters" are a joke -- one of the best jokes: the kind which many people believe).

  • If you enforce strict rules on passwords, users will rebel and indulge in practices which degrade security (e.g. writing down the password on a stick-up note concealed under the keyboard, or reuse of passwords between sites).

  • You can help users by giving them a password generator which follows high entropy rules (this time you know how passwords are generated, so you can measure the entropy). The "correct horse" method would be a good idea.

share|improve this answer
1  
Still, preventing short passwords does not hurt. You can never ensure password entropy but having rules prune out lots of bad passwords. Better than nothing. –  lOranger Apr 10 '13 at 18:57
    
Some rules help. Other (e.g. not a single letter on the same place as in the last password) actually lead to creative workarounds such as only pre-pending a single char on the monthly password change. E.g. "A1b2c#" -> "qA1b2c#" -> "qwA1b2c#" -> "qweA1b2c#" -> "qwerA1b2c#" etc. etc. –  Hennes Apr 11 '13 at 6:03
    
@ThomasPornin I agree and I'm not looking to test password strength. But I know I shouldn't allow short passwords. What is a good minimum length? Is it suggested to require at least one upper case letter and/or a number and/or a special character (?!&@, etc)? –  Eric Belair Apr 11 '13 at 11:14
    
Strictly speaking, pruning out short passwords is not necessary -- if the password generation process offers good entropy, then short passwords will be overwhelmingly rare. However, as long as a human user is involved, you cannot guarantee a good password generation process; "password rules" are there to avoid some bad password generation process. Enforcing a minimum password length has the advantage of being an "acceptable" password rule: users do not get angry (or not too much) if you force them to have 8+ character passwords (but they will if you enforce a minimum size of 10). –  Thomas Pornin Apr 11 '13 at 11:28
1  
Personally, I think all password rules except a minimum length (of no more than 8 characters) are counterproductive. Requiring one uppercase letter or a number tends to induce users into choosing passwords which are, on average, no stronger, or even weaker, than what they would have chosen otherwise. There is a Tradition of enforcing a lot of rules, but "widespread usage" does not equate "Truth". –  Thomas Pornin Apr 11 '13 at 11:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.