What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 131 Stack Exchange communities.

This question already has an answer here:

I apologize for this off-topic post, but I hope it will be read by as many moderators as possible: I just wanted to register on Stack Overflow, to be able to leave ratings, etc.

I didn't end up registering because I got so fed up by the password policy. I'd have expected more of the administrators of this site than such silly crypto-nerd behaviour (http://xkcd.com/538/). Honestly, eight unique characters, upper case, lower case, digits, special characters: Who is going to remember that? The result is only that people either use the same password for everything or write it on a post-it next to their screen. And it's going be saved in the browser, anyway. Apart from that, this is a web forum, for God's sake, not a CIA database.

It's the same at my university. Guess what, a third of their email accounts got compromised recently by a phishing attack. People tell you their passwords if you ask nicely.

Do us a favor and don't overcomplicate password protection. It actually reduces security, and annoys me.

share|improve this question

migrated from stackoverflow.com Jul 2 '11 at 22:25

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Mechanical snail, animuson, Austin Henley, Rosinante, hims056 Feb 9 '13 at 3:56

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2  
+1, i hate it when I have to come up with complicated passwords...Just make a a minimum 8 and that it. –  user159140 Jul 2 '11 at 22:15
3  
You can register with your Gmail account even, if you have one –  Rahul Jul 2 '11 at 22:18
3  
I use an OpenID login with a ridiculously simple password. How's that for security? –  omrib Jul 2 '11 at 22:23
2  
It's called Keepass. Use it, learn it, love it. –  Chris Jul 2 '11 at 23:12
    
If you don't like StackExchange OpenID you can use any OpenID provider of your choice or Google or Facebook or Yahoo. You have other possibility, use them if your not happy with the first one. –  HoLyVieR Jul 2 '11 at 23:47
    
+1, mostly for "People tell you their passwords if you ask nicely.". –  sarnold Jul 2 '11 at 23:53
    
IUseAPassPhrase2!! --pretty simple when you think about it and length is rarely an issue. –  tvanfosson Jul 3 '11 at 1:11
    
Where did you get 'unique' from? I can't make it ask me for unique characters. Like Jeff says below, it accepts Password1 (which has two ss) –  AakashM Jul 3 '11 at 19:55
    
I get the "unique" complaint for a password that is all lowercase letters with one letter repeated. No, it is not "password". –  starblue Jul 13 '11 at 12:15
1  
+1 I'm annoyed by this policy, it is overly strict for logging onto forum sites. Background: I wanted to switch from Myopenid, which is currently down. –  starblue Jul 13 '11 at 12:19
    
+1 I always construct passwords using a sentence and then change some letters into digits and special characters. As a linux system administrator I actually have about 30 passwords like that. Here however I made more than 6 tries, none of which worked, which made me finally resort to "abcABC123!@#", one of the most insecure passwords I ever had in my whole life (but probably a choice of many casual users of this site frustrated with the password restriction here). To require more than a certain length and at least 1 occurrence of characters in 2 different characters classes is simply too much. –  Dominik Wezel Sep 1 '11 at 6:44
1  
+1 Me too hate it. I check my history, I've changed my password almost 7 times within a span of 1 year. And I don't want to login using any of the OpenID options available. –  krishnajay Feb 18 '13 at 4:46

2 Answers 2

If you already have a Yahoo or Google account, it's very simple to login using one of those accounts. Just choose the appropriate icon in the login page, and put in your usual login information.

People writing down passwords because they can't remember them is a human failing, and should not be an excuse for using insecure passwords. Find a mnemonic system that can help you remember your passwords, or swap out some of the numbers or letters for symbols (replacing E with & and A with @, for example).

share|improve this answer
    
@Keoki: Um, they're all OpenID, including the Yahoo and Google options... –  Nicholas Knight Jul 2 '11 at 22:41
    
@Nicholas I didn't read the answer carefully, I thought he was just saying to create an account using new username and password. –  Cupcake Jul 2 '11 at 22:44

The browser will indeed remember the password when you log in with Stack Exchange credentials (or at least, it's supposed to).

The reason the password requirements are what they are, is because the SE credentials are re-usable elsewhere on the web as a standard OpenID:

http://blog.stackoverflow.com/2011/05/stack-exchange-is-an-openid-provider/

Of course you don't have to use them that way, but they work.

And for the record "Password1" is a valid password under these rules (don't believe me, try it -- I just did!) so it's not like they are that strict.

share|improve this answer
15  
The problem is not that they are strict, but that they are arbitrary. "Password1" is valid, but "kejkld%&#dswilk" is not. –  Tim N Jul 30 '11 at 22:22
    
I don't understand this part: The reason the password requirements are what they are, is because the SE credentials are re-usable elsewhere on the web as a standard OpenID. Are credentials from other OpenID providers not also reusable? They don't have excessively complicated password requirements. Why does SE? –  oscilatingcretin Jul 6 '13 at 22:21
    
8 characters (not necessarily all unique) from 3 of the 4 character categories has always worked for me (and for other OpenID password requirements -- my usual password is always rated as quite strong on those sites that show a password rating meter), so I question the need for the addition of the uniqueness requirement for the SE OpenIDs, given that all OpenID login credentials are re-usable elsewhere on the web as a standard OpenID. –  RobH Sep 3 '13 at 17:03