4

I'm looking for a definitive guide to the rules that determine a "strong" password for website authentication. It seems many websites have many different rules, and I'm not sure what is the best option for making users create strong, but still easy to remember passwords.

Improve this question

2 Answers 2

Reset to default
7

See this.

Important points:

  • You cannot test for password strength, on looking at the password alone. Password strength is a property of how the password is generated, which you cannot measure or even estimate more or less approximately by just looking at the password ("password meters" are a joke -- one of the best jokes: the kind which many people believe).

  • If you enforce strict rules on passwords, users will rebel and indulge in practices which degrade security (e.g. writing down the password on a stick-up note concealed under the keyboard, or reuse of passwords between sites).

  • You can help users by giving them a password generator which follows high entropy rules (this time you know how passwords are generated, so you can measure the entropy). The "correct horse" method would be a good idea.

Improve this answer
5
  • 1
    Still, preventing short passwords does not hurt. You can never ensure password entropy but having rules prune out lots of bad passwords. Better than nothing.
    – Laurent Grégoire
    Apr 10, 2013 at 18:57
  • 1
    Some rules help. Other (e.g. not a single letter on the same place as in the last password) actually lead to creative workarounds such as only pre-pending a single char on the monthly password change. E.g. "A1b2c#" -> "qA1b2c#" -> "qwA1b2c#" -> "qweA1b2c#" -> "qwerA1b2c#" etc. etc.
    – Hennes
    Apr 11, 2013 at 6:03
  • @ThomasPornin I agree and I'm not looking to test password strength. But I know I shouldn't allow short passwords. What is a good minimum length? Is it suggested to require at least one upper case letter and/or a number and/or a special character (?!&@, etc)?
    – Eric Belair
    Apr 11, 2013 at 11:14
  • Strictly speaking, pruning out short passwords is not necessary -- if the password generation process offers good entropy, then short passwords will be overwhelmingly rare. However, as long as a human user is involved, you cannot guarantee a good password generation process; "password rules" are there to avoid some bad password generation process. Enforcing a minimum password length has the advantage of being an "acceptable" password rule: users do not get angry (or not too much) if you force them to have 8+ character passwords (but they will if you enforce a minimum size of 10).
    – Thomas Pornin
    Apr 11, 2013 at 11:28
  • 1
    Personally, I think all password rules except a minimum length (of no more than 8 characters) are counterproductive. Requiring one uppercase letter or a number tends to induce users into choosing passwords which are, on average, no stronger, or even weaker, than what they would have chosen otherwise. There is a Tradition of enforcing a lot of rules, but "widespread usage" does not equate "Truth".
    – Thomas Pornin
    Apr 11, 2013 at 11:31
6

Many of the rules you see in practice are quite useless. Requiring at least one capital letter and a number annoy users who are not allowed to pick password, but it fails to induce them to pick a good one. In general, they just pick Password1 instead. That password would pass many filters, but still it has been leaked over 100 000 times.

You can try to make your rules more complex. Let's say the number can't be at the end! Well, your lazy users will put it at the front instead. That password has been leaked over 2 000 times. You can continue this game of cat and mouse with your users, but it's a loosing game. You will annoy your users more and more, and unless they drop out in frustration they will still pick shitty passwords. People are lazy, and you can not change that with complicated rules or entropy calculations.

So, what to do instead?

  • Length limits: You should have a minimum length. This should be at least 8, but 10 or 12 is probably better. If your hashing algorithm has a max length (e.g. bcrypt cuts everything at 72 characters), you should enforce that max length as well so that users don't belive their password is longer than it actually is. But don't enforce a short max length like 32 for no reason.
  • Blacklist common passwords: This is important. Very important. You need to check the password against a long list of leaked passwords. If the password has been leaked more than N times (personally, I'd argue for N = 1), block it. To date, the best such list is Pwned Passwords.
  • Blacklist obvious picks: A tempting choice of password is to just reuse the username or some other personal info provided, the site name or a variation thereof, or a term strongly related to the topic of the site. One way to do this is to check that the password still passes the minimum length requirement even after you remove any such words. You don't want to let users pick LetItGo as password on your Frozen fan site.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .