What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 134 Stack Exchange communities.

Why the crazy password requirements? It a Q&A site, and I have to conform to arbitrarily chosen password complexity criteria.

With a 22 random lowercase characters (entropy 119 bits), the create account page asks me to:

enter image description here

Just adding uppercase characters to the mix does not satisfy the requirements. With 125 bits of entropy, It still asks me to:

enter image description here

Fortunately, doing either of these does satisfy the requirements. As long as there are enough unique characters. The password a1ᓕ♵Ŀꁏꂯ (with a1 replacing Unicode characters to satisfy the numbers and letters requirement, reducing the level of entropy from 112 to 88 bits) still causes the generator to insist that the password:

enter image description here

Sadly, the famous correct horse battery staple password doesn't fly, either:

enter image description here

I add entropy in my passwords in other ways than the Password1 (entropy approximately 0) mechanism suggested by these requirements, and prefer to use the Stack Exchange OpenID provider.

share|improve this question
5  
I added some examples because most people viewing this question will have created their profile a long time ago and forgotten about the requirements. Feel free to roll back or modify if you don't like my edits. –  Kevin Vermeer Oct 31 '11 at 3:14
8  
Obligatory XKCD reference. –  Chris Frederick Oct 31 '11 at 3:16
24  
Obligatory meta-XKCD reference. –  Rick Sladkey Oct 31 '11 at 3:20
3  
For those currently reading, the obligatory XKCD reference is now in the question. –  TCPMAN.EXE Oct 31 '11 at 3:35
2  
Thank you for reminding me why I use OpenID. –  Wladimir Palant Oct 31 '11 at 6:57
17  
"Why the crazy password requirements? It a Q&A site" -- It's not just a Q&A site, it's an OpenId provider (which you know, since you mention it). Also: security.stackexchange.com/questions/3913/…, so we have an on-topic reference as well :) –  balpha Oct 31 '11 at 8:00
4  
@balpha that's not the only reference we have: security.blogoverflow.com/2011/10/how-long-is-a-password-string –  user142852 Oct 31 '11 at 12:40
    
As posted in my answer to the duplicate question if you're creating a long-length string of arbitrary characters, what is the difficulty in adding upper-case or uniqueness? If users like you aren't truly inconvenienced (other than for the sake of academic discussions), and the alternatives are to have no restrictions at all or to have equally arbitrary yet different-than-the-current restrictions, what is the drawback to the current situation and how would a change improve it? –  Farray Feb 22 '12 at 21:36
2  
@Farray What about making a long-length string of only lower case letters? More secure than Password1 and easier to remember than the average random string. What about the fact that 8 unique characters is a significantly smaller search space than 8 arbitrary characters? It'll block aaaaaaaa, sure, but as noted Password1 still passes. The dumb will be dumb unless the requirements are so insane as to be impossible; making everyone jump through hoops in a failed attempt to mitigate reality is not something that makes sense to me. –  Matthew Read Feb 22 '12 at 22:11
    
@MatthewRead Your point about smaller search space is valid, but perhaps mitigated by the apparent lack of maximum length. I agree that the dumb will be dumb, but that doesn't mean they should be ignored. In this case I happen to think that the smart are minimally inconvenienced one direction, while the dumb are minimally inconvenienced the other direction. A good compromise... –  Farray Feb 22 '12 at 22:43
    
If someone sums up some great reasons for why they should change the criteria, I'll award the bounty to them. None of the current answers really answers the question. –  Emil Mar 25 '12 at 16:02
2  
Ugh... I just found out about SE's excessively-complex password requirements because MyOpenID is down and I can't login to another SE site. I went to create an SE account and found that my PW requires 3 lowercase, three uppercase, three numbers, and three special characters??? That is beyond ridiculous. At the very least, how about any combination of casing, numbers, and special characters so long as at least two are present (ie, mix/match of upper/lower, lower/number, upper/special, etc)) –  oscilatingcretin Jul 6 '13 at 15:57
    
For people coming to this more recently, see meta.stackexchange.com/q/187759/160917 for a discussion of this requirement from a technical perspective. The short version: the password criteria are well-intentioned but ultimately I suspect they might be counter-productive. –  D.W. Sep 6 '13 at 20:47

4 Answers 4

Kevin Montrose's concern is that ordinary users will be confused by an entropy meter. That does not justify blocking good passwords, which is what the current system does.

A simple way to satisfy both criteria:

  • Calculate entropy in the background. Any password with entropy over some threshold will get accepted.
  • Passwords with less entropy than that fall back to the system shown. For example, if someone gives a low-entropy password that contains only letters, it could suggest adding "upper case, numbers, or special characters". To avoid being user-hostile, passwords that meet all the constraints could be accepted (even if they have low entropy).

    You claim that you're using your password criteria to enforce security for OpenID accounts. That's fair—except the current system accepts qwerty1! as a password. Seriously? If you're going to "fall on the strict side" for security, you shouldn't be accepting passwords with 6.322 bits of entropy (according to zxcvbn).

There exist libraries to quickly estimate entropy, such as the one Dropbox uses.

share|improve this answer
10  
Has anyone from SE actually produced a legitimate, sensible reason as to why they are absolutely not going to reconsider loosening up the password requirements? –  oscilatingcretin Jul 6 '13 at 22:23
    
To paraphrase: "We are sorry, this password does not meet our network's strengths standards." –  badp Apr 3 at 19:58
    
Some insight: maybe they're afraid that moderator accounts may get hacked with password123... there's a lot of data that shouldn't be available to anyone except mods. –  Annonomus Penguin Apr 4 at 1:28

I appreciate that there is no way that this policy is ever going to change based on what I have to say, but it is a good example of listening to your customers needs, and then ignoring them to go off and do something fun instead.

  1. Stack Exchange initially only allows login using openid.
  2. Lots of people don't like that. We just want to log into a Q&A site and ask a question. We don't want any connection between this site and our gmail account or our facebook account or whatever. Having a single password that if broken allows access to everything about their life doesn't seem more secure to us. It's not even clear whether Stack Exchange will now have access to their gmail or facebook account. Presumable not, but who knows? All we want is to give an email address and password and log into the site to ask a question.
  3. Stack Exchange says that the acquisition of new users is a very high priority. The openid thing is deterring users, so they fix it. Hooray, everybody is happy.
  4. Especially the developer who, instead of having to so some boring password authentication, gets to play with openid.
  5. But the password standard is needlessly zealous. We have an intuitive understanding of when it is important to have a really good password, and sorry but a Q&A site does not make the cut.
  6. But the password standard can't be lowered to something more appropriate for a Q&A site, because instead of doing the simple thing and allowing people to log on using an email address and password, Stack Exchange did the fun thing instead with openid.

Now I personally will cope with the password rules because I have seen the effectiveness of stackoverflow.com before, and I need a question answered for work. But I wonder, how many people who stumbled upon Stack Exchange gave up at that first barrier?

So if anybody from Stack Exchange is out there reading, maybe consider the following:

  1. Stack Exchange really wants new users.
  2. A simple password is sufficient for a Q&A site.
  3. The current password system is turning potential new users away at the door.
  4. You could fix it if you wanted to.
share|improve this answer
5  
-1 for ranting based on paranoiac opinion and made-up stories, but pretending it's based on facts. –  balpha Jun 14 '12 at 6:09
4  
Funny story. Particularly the bit where you imply your gmail account is a poor choice because it might get hacked, and then go on to express a desire for a weak password because it's just a Q&A site (and therefore presumably you don't care if it's hacked). But if I can be serious for a minute: the best way to protect your SE account is to use multiple, separate forms of authentication - that way if you lose access to one, you can still use the other (and even revoke the first). –  Shogging through the snow Jun 14 '12 at 7:31

Stack Exchange username/password accounts are actually OpenIDs, not something tied to the Q&A portion of the network ( https://openid.stackexchange.com/ ).

Because these accounts aren't constrained in use (by design) we can't assume anything about the "importance" of the account, thus the rather stringent password constraints.

What the password contraints are meant to do is act as a "normal person"-readable proxy for entropy.

Directly exposing entropy measurements to a registering user would be absurdly user hostile, and a simple yes/no indicator just begs the question "why isn't my password acceptable?" (you can't just say "not enough bits!").

In short, while you and I (and a non-trivial number of the people reading this, I'd wager) can reason about Shannon entropy the typical end user cannot. The character class stuff is a reasonable approximation that has the benefit of being explainable, and we fall on the more strict side because security is involved.

So no, we won't be relaxing the openid.stackexchange.com password requirements.

share|improve this answer
21  
I'm sorry, but .. what? These arguments are not convincing me at all. –  Emil Mar 19 '12 at 21:29
17  
If the security of these accounts were actually a concern you'd improve things far more by not leaving so many them many of them unknowing logged in than by implementing ridiculous requirements like this. –  Jeremy Banks Jun 5 '12 at 5:13
3  
Lots of passwords have "very weak, weak, acceptable, strong, very strong" I fail to see how anyone would find that confusing, expecially with a hint; make the password contain more words, be longer, or include more special characters to make the password stronger" –  Richard Tingle Jul 4 '13 at 8:26
3  
And the whole point is that passwords created with these requirements arent strong, as xkcd says "We've trained a generation of internet users to pick passwords that are hard for people to remember but easy for computers to guess" –  Richard Tingle Jul 4 '13 at 8:30
5  
"thus the rather stringent password constraints" These are not stringent password constraints. They are nonsensical password constraints that reduce the security of the account. –  endolith Jul 4 '13 at 16:13
    
You could also say "days to crack." Or is that still too complicated for users to understand? I suppose we can't expect users to know what passwords do at all. –  AAA Mar 3 at 15:40
    
While opposing this decision for the reasons others stated, if the decision stands, I suggest: (1) in the pop-ups, put "unique" in bold (it's unambiguous but it's not obvious); (2) fix the bug that causes the pop-up to sometimes advise a change, and then advise the SAME change when the advice is followed (see my answer for an example). –  WGroleau Apr 3 at 17:19
    
So... how is "why isn't my password acceptable?" different from "how does my post not meet the network's quality standards?" :) –  badp Apr 3 at 20:00

Make a two-column table: two-char language codes against a very common word in that language. Randomly pick a row from that table. Ask Google or other search engine "Show me pages in language xxx containing word yyy" Randomly pick one of the the fifth through zzz hits. Randomly pick a word from that page. Repeat. Stick the two words together. Write them on a post-it Stick that on the bottom of your keyboard. Cuss and swear because all the sites only accept ASCII characters.

My problem is that I followed the usual asinine rules exemplified in XKCD for nine characters, and SE said I need one more character. So I invented a new one with ten characters and SE said I need one more character.

UPDATE: One more unique character, i.e., one not yet used. So 5tack-Exch@nge! would probably work :-)

By the way, “gizmo didn't eat chicken after midnight” was accepted. I didn’t try to log in with it, though.

Next experiment: Pasted in two Chinese words separated by a semi-colon. The request was to add one capital letter or digit. Putting a '2' on the end still got the same request.

share|improve this answer
    
Downvoted why? Won't work? Insecure? Didn't like the sarcasm? –  WGroleau Mar 3 at 15:51
1  
I'm not a downvoters but i'm not really sure what you're saying here. If it was a question I would vote to close under "unclear" –  Richard Tingle Mar 3 at 15:57
1  
Your post didn't really add any information. –  AAA Mar 3 at 16:16
    
The information it added is (1) a description of a way the rules can be misinterpreted; (2) two things that are both easy to remember and fairly secure, yet aren't rejected by the rules so many of us hate; and (3) something that complied with the stated rules and yet was rejected. My apologies if the sarcastic intro obscured that. –  WGroleau Mar 7 at 19:00

You must log in to answer this question.

protected by kiamlaluno Apr 4 at 4:13

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .