Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

This is the password policy I just got from UPS (just for package status checking):

Your password must be between 8 and 26 characters long. It must contain at least three of the following character types: lowercase letters, capital letters, numerals, special characters, or spaces. The password may not contain your User ID, your name, or your e-mail address. (SSO_1007)

I actually have to wrack my brain somewhat to generate this password, but not only that, most importantly, I am sure that after 3 days I will forget what this password is. Users won't be so happy. Password reset can be frequent. I think users will try to avoid using the site unless they have to.

What is a reasonable and secure password policy when setting up a website? I think some companies may fear some hackers trying passwords a million times or more, so they add all those requirements for "special characters, lower case, upper case", but won't it be reasonable to turn off the account or just disable the password and require a password reset if a user has tried 30 times or 100 times? Or, add a 5 second delay each time after the user tried 30 times? If so, then those special characters won't be that much needed.

share|improve this question
    
if you're resetting the password after 30 trys, you just give a great possibility to annoy other users to the bad people (hackers / script-kiddys) wich would make everything even worse. –  oezi Oct 12 '11 at 15:31
    
@oezi you mean, hackers can annoy the good people by just logging in 30 times with some fake passwords? What about the 5 second delay after 30 times of attempt I just added? –  動靜能量 Oct 12 '11 at 15:34
13  
Not to mention that I can't take a password maximum length seriously when it doesn't allow "Correct horse battery staple". –  David Thornley Oct 12 '11 at 15:52
6  
How about the second method below in this Xkcd comic? –  Robert Harvey Oct 12 '11 at 16:32
6  
Hi 動靜能量, this is likely a better question for a sister site, IT Security, but it's been asked and answered there in several different forms. Check out questions like this one or for more information on the context around Robert Harvey's comment, have a look at this question. –  user8 Oct 12 '11 at 18:30
show 1 more comment

8 Answers

Secure vs. Convenient

The security policy of a password should be appropriate for the cost of compromise. If your website fronts my financial account I would like stringent password protection. If it is a niche fan site about Autobots, you don't need very much protection.

The UPS rules are reasonable with the exception of:

  • The maximum length is way too small. You should facilitate the use of passphrases which are easier to remember and can be more secure.

I didn't see the reset after X number of tries in the quoted rules, I think this is silly in most cases. I think your better off locking someone out for a period of time, rather than forcing a reset. This implies a certain level of security. If that isn't necessary, then it's not and locking/resetting is a moot point.

There are many password policy rules that having marginal security benefits at best. However, there are also rules that do have real, tangible benefits to the security of your password.

Rules (and the reasons):

  • minimum length

Prevents a combinatorial trial and error attack which will quickly break very short password.

  • proscription against using a single English word (or any other language)

This prevents dictionary attacks.

  • forced inclusion of different categories (ie. mixed case, numbers, punctuation)

This increases average attack space.

All these reasons can be traced to minimizing the user's bias in choosing passwords. Most users are biased towards creating shorter, easy to remember passwords. Unfortunately that usually makes the password easier to attack. What most users need are instructions on how to create secure memorable passwords or a longer passphrase.

Secure Memorable Passwords

When I need to create a password with a length limit I always start with a phrase so I have a built in mnemonic. I take the phrase and I get the same positional character from each word. I now have a sequence of just characters. I then choose capitalization, some based on proper names in the phrase, or by pattern (first and last, every other letter, etc). I then add in punctuation and numbers based on some arbitrary rule or pattern. (ie. all 'j's are 7, using '&' where there is an 'and' in the phrase, etc).

Mama, just killed a man. Put a gun against his head. Pulled my trigger, now he's dead.

Phrase provided by Queen

  1. mjkampagahhpmtnhd - first letter of every word
  2. MjkamPagahhPmtnhd - casing matches casing of phrase
  3. Mjk0mP0g0hhPmtnhd - changed 'a' to 0
  4. Mjk0mP0g0()Pmtnhd - changed 'his head' to ()

After I type it a few times when thinking the phrase I'll never have a problem remembering.

share|improve this answer
1  
Real problem is that the UPS account will be used by a dozen people in the company. Locking them all out because Fred in shipping mistyped it will cause 1, chaos 2, people to switch to Fedex –  Martin Beckett Oct 12 '11 at 18:49
2  
I think the problem is that obnoxious password policies do not increase real security (they increase only the perception of security) and can actually harm security. –  Loki Astari Oct 12 '11 at 19:03
    
@Martin Beckett: 1) For environments that use a locking policy there should be, and usually are alternate ways to immediately unlock your password 2) Each person should have there own account 3) B2B security is usually better accomplished through public key systems like PKCS which don't have to use passwords. –  dietbuddha Oct 13 '11 at 7:06
2  
Your ideas above seem logical but in reality you are defeating your self xkcd.com/936. I basikely disagree with three of your 4 points and would suggest that these all lead to easier to krack passwords. (Length being the only positive). The best password would d be: Mama, just killed a man. –  Loki Astari Oct 13 '11 at 9:32
1  
+1 for "The maximum length is way too small". –  barjak Oct 27 '11 at 16:49
show 3 more comments

Be sure to allow spaces. Everyone I know can type short phrases faster than they can type the first letter of each word in the phrase. Eg try typing Bird in a Tree and then BiaT. This has the advantage that if you write a vaguely work appropriate phrase like pick Up milk or Meetings all day on a sticky note, it isn't obviously a password.

I'm not a big fan of the "you must have numbers and symbols" rules, but if you apply them consistently (eg i is always 1, a is always @) then you can still write the English phrase on the sticky, apply the known-only-to-you-leet-speak rules, and enter B1rd in @ tree on the password dialog. From a security point of view, the numbers and symbols don't add much, but they don't need to make you crazy as a user.

Sites with maximum password length make me angy if my nice phrase is deemed "too long". 26 seems reasonable. I understand someone has to design the width of the column, but 12 is just stupidly short.

share|improve this answer
    
This is very clever. Use a spaced evey day phrase... Clever. Although I'll stick with my system of a common strong password with added number and letter depending on the service I'm logging in. Only I know how to form those and it's always the same but the resulting password is very likely different (not always different though but I don't care much about those rare duplicates). –  Robert Koritnik Oct 13 '11 at 12:14
1  
The width of what column? Text-boxes usually have internal scrolling, and if you're storing the plaintext password in the DB you're Doing It Wrong. –  Peter Taylor Oct 13 '11 at 12:20
add comment

Using bcrypt when storing the password is a good first start, simply because it makes brute-force hacking attempts unfeasible.

share|improve this answer
add comment

Not a dictionary word, or a trivial variation of it. That's it. A bundle of two dictionary words is pretty much uncrackable. A single-letter substitute for a character that is not an obvious substitute (0-O, 1-I, 5-S) too.

Also, if you limit response time - password accepted/denied after 1s, and no two parallel attempts for the same login allowed - one must finish (OK or error) before you try another, any non-dictionary 6-letter all-lowercase no-special-characters password will take 9 years to break.

share|improve this answer
add comment

Your password must be between 8 and 26 characters long

The minimum password being 8 characters long is a legacy of Lan Manager. Lan Manager hashed passwords by breaking them up into 2 7-character strings, then hashed them. By requiring 8 chars minimum, they guaranteed that the 2nd word was not the same as for a blank password (there was no salt, so every instance of 7 blanks hashed to the same result).

I am sure that after 3 days I will forget what this password is.

I've given up, the rules are so silly and rediculous that I write them down now. All except the few I use for websites. My current employer also keeps track of the past 24 passwords used so that they cannot be recycled, nor can the password contain any 3+ character English word (forwards or backwards). It also makes sure you don't use a previous word and increment some number as part of it (so if P4ssw0rd1 were used, you could not use P4ssw0rd2, nor P4ssw0rd0).

I learned my lesson the hard way at the office when I had to change a password, it took 45 minutes to get the system to accept a replacement, then promptly forgot what I had come up with and had to get it reset and wasted another 45 minutes trying to get something I could remember that was complex enough to meet the requirements (some of the requirements are listed above, some aren't, and some I don't know). It is not a lot of fun trying to come up with something that meets rules you aren't allowed to know. At least with games like Mastermind you are given clues as to how close you get. At the office, some folks get to use a smart card, I'm not one of them.

share|improve this answer
add comment

My opinion is that passwords should have only a length requirement. You don't want someone putting in "a" as their password. And as the xkcd answer shows, an extremely difficult to remember password isn't always that secure. Always allow people to change their password as well. And forget about the "you can't use any of the characters contained in your previous password" crap.

Making an obscene password policy will do more harm than good. At the college I went to the password policy was similar to the UPS policy AND you had to change it every 2 weeks AND you couldn't use the previous 50 passwords you used. So, what my teachers recommended when setting us up accounts is to use our regular password that conforms to the rules and add a counter to the end of it and put in your password hint what the counter number is.

Also, a strict password policy won't do anything whenever your plain text database gets hacked by a SQL injection bug... or you email passwords to your users and it gets intercepted..

Basically, don't make your password system a hassle for your users or it will encourage them to do insecure things so that they can work around it. For instance, my company when getting a dedicated server from a data center, they set us up passwords that were 20 characters long. They were too secure to be emailed to us and had to be faxed. We couldn't change the passwords, only request for a new 20 character password to be generated. And it was this way for every user... so what we ended up doing is just making a text document on our desktops with the password. Also, we don't use them anymore because for all the "security" they had, they were really quite insecure.

share|improve this answer
    
Not to mention that if you make a password hard enough to remember, your users turn to the sticky note pad on their desk. A "secure" password that leaves everyone pathetically open to social engineering isn't secure. –  Fomite Oct 13 '11 at 10:14
add comment

Reasonable and Secure are mutually exclusive. They are two ends of a rod. Striking a balance in the middle will be best. To far towards secure and people write down the passwords or use the totally un-secure password unlock feature.

The above example does appear to be leaning more towards secure than reasonable. I have seen worse.

I prefer leaning towards the reasonable. The key is to lean towards the secure in your back-end. Store as little as possible use salts etc. All the latest recommended methods for encoding the passwords into your database and encoding them one way as well. Then keep your database and your code secure. Also train anyone that has admin rights to your system that they need to use a unique secure password. It was shown recently that stringing together multiple dictionary words is more secure than dragging in special characters and case. It required compound dictionary matches which really add up time wise for hackers, however, these were still memorable for users.

share|improve this answer
1  
Reason and security aren't opposed concepts. They can conflict, but it's usually possible to come up with something reasonably secure and reasonably usable. It may require a bit of creative thinking, and can't be adequately measured on a checklist, which may be why it isn't seen that way many places. –  David Thornley Oct 12 '11 at 19:37
    
There is a lot of history where reasonable and security are at opposite ends. You can either allow users to have reasonable passwords (no checks, anything goes) and that is probably the least secure, or maybe no password even less secure. Microsoft learned this the hard way. People wanted better email, so they decided hey lets allow scripting like in word, then came the email viruses. It's been a battle ever since. You can't have web enabled email (reasonable) without opening yourself up to security risks –  Bill Leeper Oct 12 '11 at 21:39
    
Sure, it's easy to have ease of use and security diametrically opposed, if you don't make good choices. A lot of Microsoft choices back maybe in 2005 and before were made apparently with no eye to security. –  David Thornley Oct 13 '11 at 2:32
    
Please, give an example where you have ease of use AND security. I have worked a lot of places and implemented a lot of secure systems and have yet to see this. And this would be a regular web app not something like using a .ssh key to access a remote system. My grandmother needs to be able to do this on her Windows Vista system :-) –  Bill Leeper Oct 13 '11 at 13:54
    
Consider passphrases, such as the recent xkcd. More secure than most passwords, typically easier to remember than the good ones, and frequently over the 26 characters the site allows. –  David Thornley Oct 18 '11 at 0:57
add comment

To be honest, I find having strict password requirements to be an annoyance and not a benefit. I would say as a rule the most reasonable is to just specify a length, maybe special characters + alphanumeric. Anything more is asking for people to write down their password, which defeats the whole purpose of having secure passwords. I also hate having to change your password every x days with the usual ridiculous set of rules (e.g. cannot re-use the last 25 passwords) - again all that does is force people to write the thing down so they don't forget, at which point you might as well not ask for a password at all.

share|improve this answer
4  
Writing down passwords does not defeat the purpose. If I have a really complicated password written on a post-it stuck on my monitor then the only way someone can access my account is if they have broken into my house and are sat at my desk in my study. In this situation I have a far, far bigger problem than someone being able to track my UPS deliveries. –  Qwerky Oct 12 '11 at 16:00
2  
What if it's a company policy and a co-worker finds somebody's password? Damage can still be caused, and the supposed secure password policy does little to help if it's so complex that most people just post-it to their monitor so anyone passing by can find their password for company data. –  Wayne M Oct 12 '11 at 16:01
2  
+1, I completely agree w/ Wayne. A large, if not the largest chunk of security threats come from 'the inside'. Policies that force users to end up writing down passwords completely defeat the purpose. –  GrandmasterB Oct 12 '11 at 19:01
1  
Not to mention the fact you can annoy the heck out of users if they need to think of some overly complicated password to fit the rules. –  Mavrik Oct 12 '11 at 20:17
1  
@mouviciel I trust it enough to put things like my wallet and phone in there, which I value more than nearly every online account I have. –  Qwerky Oct 13 '11 at 14:01
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.