Secure vs. Convenient
The security policy of a password should be appropriate for the cost of compromise. If your website fronts my financial account I would like stringent password protection. If it is a niche fan site about Autobots, you don't need very much protection.
The UPS rules are reasonable with the exception of:
- The maximum length is way too small. You should facilitate the use of passphrases which are easier to remember and can be more secure.
I didn't see the reset after X number of tries in the quoted rules, I think this is silly in most cases. I think your better off locking someone out for a period of time, rather than forcing a reset. This implies a certain level of security. If that isn't necessary, then it's not and locking/resetting is a moot point.
There are many password policy rules that having marginal security benefits at best. However, there are also rules that do have real, tangible benefits to the security of your password.
Rules (and the reasons):
Prevents a combinatorial trial and error attack which will quickly break very short password.
- proscription against using a single English word (or any other language)
This prevents dictionary attacks.
- forced inclusion of different categories (ie. mixed case, numbers, punctuation)
This increases average attack space.
All these reasons can be traced to minimizing the user's bias in choosing passwords. Most users are biased towards creating shorter, easy to remember passwords. Unfortunately that usually makes the password easier to attack. What most users need are instructions on how to create secure memorable passwords or a longer passphrase.
Secure Memorable Passwords
When I need to create a password with a length limit I always start with a phrase so I have a built in mnemonic. I take the phrase and I get the same positional character from each word. I now have a sequence of just characters. I then choose capitalization, some based on proper names in the phrase, or by pattern (first and last, every other letter, etc). I then add in punctuation and numbers based on some arbitrary rule or pattern. (ie. all 'j's are 7, using '&' where there is an 'and' in the phrase, etc).
Mama, just killed a man. Put a gun against his head. Pulled my trigger, now he's dead.
Phrase provided by Queen
- mjkampagahhpmtnhd - first letter of every word
- MjkamPagahhPmtnhd - casing matches casing of phrase
- Mjk0mP0g0hhPmtnhd - changed 'a' to 0
- Mjk0mP0g0()Pmtnhd - changed 'his head' to ()
After I type it a few times when thinking the phrase I'll never have a problem remembering.