I understand that passwords with varying cases (upper and lower) as well as numbers and special characters are much "stronger" and harder to crack than those that are short and all lowercase or whatnot.

However, I wonder why is everyone adopting this as a standard for their passwords, even on unimportant sites that have no personal information?

For example, no disrespect intended, but why does my password need to be "strong" to log on to StackExchange? There is literally nothing on this site that needs to be "protected". What is the worst that can happen if someone does get your password? That they can posts a bunch of bad answers from your account? lol It just seems silly to have a strict password requirement for a site that does not need one.

closed as primarily opinion-based by Iszi, Adi, Scott Pack, TildalWave, NULLZ Sep 26 '13 at 0:14

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    No-one thinks of their own site as unimportant! – bobince Sep 25 '13 at 10:03
  • 5
    The problem with stack exchange is that it's an OpenID provider. You might use it to log into more important sites. – CodesInChaos Sep 25 '13 at 12:06

Identity thieves have long used a simple trick: as soon as you've cracked an account for one person, that password becomes the first thing you try for all of their other accounts.

Most of the time, this actually works. Most people use the same password for everything. Most of the rest have a few passwords, but no real system for deciding which passwords get used for what data, so "important" and "unimportant" data sometimes gets locked behind the same password. Because of this, the passwords on your site may be protecting "important" data, even if you think that the data on your site is "unimportant." To use the SE example: what about you? Maybe you store nothing "important" on SE, but do you lock other "important" data behind the same password? If you do, you're vulnerable, and even if you don't, many people do.

We cannot make users implement perfect security practices, but we can make them implement one good practice: strong passwords, every time. Or at the very least, we can choose to educate people who do not know enough, and to refrain from enabling people who do not care enough. That is the point of strong passwords, even on sites like this.

For example, no disrespect intended, but why does my password need to be "strong" to log on to StackExchange? There is literally nothing on this site that needs to be "protected".

Many people are using Stack Exchange with their true names as it helps with job searching. I wouldn't want someone to hack into my account or hijack it. My creditability is at stake and that requires protection.

This is kind of two questions in one:

  1. Why does there seem to be a trend towards longer passwords on sites today?

  2. Why does Stack Exchange require passwords to be a certain length?

I'll tackle #1 first:

There are many reasons why a site (even one that some of it's users consider low value) would want to require password length. Length is the easiest way to require better passwords. Explaining to a user that they need to have at least one of numbers, uppercase letters, lowercase letters, symbols, etc is harder than simply saying "Your password must be 8 characters or longer".

Raising the bar on passwords might (not guaranteed) decrease fraud, contacts to CS, etc. There's also the reputation issue, well known sites that allow very weak passwords get dinged from time to time in articles and blogs. Adding on to this, a site may seem inconsequential today but 100M users later the perceived value can change. How many people knew they would care about their FB account five years later. Would you be comfortable if your FB password was "a"?

For #2 - Stack Exchange's password policy:

That's entirely up to them. One of two things probably happened, a lone developer picked a requirement off the top of his head and went with it or they had a discussion and made a reasoned decision based on .

Your choice as a user is to reject their decision and not use the site because they require 8 characters and you only wanted to use 6 or you can pick an 8 character password (and maybe let your browser remember your password).

One thing to keep in mind that not everyone shares your view of the world or your view the sites they use. Right now you have 1 reputation point in IT Security, when you have a few thousand you might assign a higher value to your SE account.

You answer your own question about password complexity. Simple passwords can be cracked in no time. Complex passwords take time to crack. Requiring more complex passwords makes the attacker take more time to compromise an account.

Your own SE account may not be worth anything. That may be the same for many others. Is it the same for all accounts? Where would SE be if everyone's account were compromised? Where would SE be if the data on the servers were not trustworthy - answers were incorrect?

As a web developer the thought of a malicious user accessing someone else's account without their consent is unacceptable to me. I suppose the answer is that the people running sites like StackOverflow take pride in their work. I think it also helps users have confidence that the people in charge of the site know what they are doing.

On a side note, I got my last job off of the careers.stackoverflow site in part because of my profile. As you can imagine, the security of the site is very important to me because my account had an indirect impact on my financial life.

Scenario 1:

How about I hack into Thomas Pornin's account because he has 'password' as his password for SE - and then ask you to install this new security agent on your production machine for some hardening servers question that you asked. And then happily live ever after storing my backups on your secure server (or do even nasty things)

Scenario 2: (a bit saner one)

What if SEs password hashes get compromised and attackers are able to crack lots of weak passwords. Cracking these weak passwords entails being able to brute force their salts. I am not a crypto expert but a lot of correct salt values can give good hints (like salt length etc.) to a cryptanalyst to fine tune his brute force algorithm. If one is able to do that - it means more passwords get cracked easily. Does this seem like a good incentive to accept strong passwords only.

Scenario 3

lol It just seems silly to have a strict password requirement for a site that does not need one.

It definitely needs a good password. I don't know about you but I'll be very offended if someone guesses my password and puts a cat pic in my profile image.


Strong passwords are not only about protecting you from getting your identity stolen, its also about creating a solid secure system that safeguards everyone using the system.

  • 8
    Salts do not need to be brute forced. The salt is not considered secret. – atk Sep 25 '13 at 0:32
  • Well I meant what if you only have hashes. What do you do to crack the password then. Brute force password and brute force salt, isn't it ? In such an approach what if you find out that the salt is only a 2 character string !! Does it not make your job easier ? – CodeExpress Sep 25 '13 at 21:41
  • If the system only stores the salted hash but not the salt, then it every valid authentication will require brute forcing the salk to get the hash. I have seen this called a 'pepper'. In my experience, it's so computationally intensive for normal operations that it is basically useless. This particular cure is worse than the disease, in most circumstances. And there's no cryptographic reason to hide the salt. – atk Sep 25 '13 at 22:10
  • Well I understand that salts are NOT a secret and they are stored in plain text. Afterall, you need to store the salt (or the pepper) to validate the password. All I am trying to say is a scenario where an attacker just manages to get the hashes (as against a full database table). In such a case, he has two things to brute force - the password as well as the salt. Now in this case if a very easy password like 'password' helps in revealing that the salt is probably a 2 character string, then attacker has a definite advantage for cracking the rest of the passwords. Isn't it ? – CodeExpress Sep 26 '13 at 2:39
  • Yes, an attacker that gets access to the hash but not the salt has additional work ahead. It's generally not worth trying to architect a solution for this particular edge case unless you have very unusual needs. Yes, the more the attacker knows about a system the easier/more efficient it is to attack. This is generally the case for most systems :-) – atk Sep 26 '13 at 12:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.