Can Stack Overflow change the password criteria?

Question

Why the crazy password requirements? It a Q&A site, and I have to conform to arbitrarily chosen password complexity criteria.

With a 22 random lowercase characters (entropy 119 bits), the create account page asks me to:

Just adding uppercase characters to the mix does not satisfy the requirements. With 125 bits of entropy, It still asks me to:

Fortunately, doing either of these does satisfy the requirements. As long as there are enough unique characters. The password a1ᓕ♵Ŀꁏꂯ (with a1 replacing Unicode characters to satisfy the numbers and letters requirement, reducing the level of entropy from 112 to 88 bits) still causes the generator to insist that the password:

Sadly, the famous correct horse battery staple password doesn't fly, either:

I add entropy in my passwords in other ways than the Password1 (entropy approximately 0) mechanism suggested by these requirements, and prefer to use the Stack Exchange OpenID provider.

Answer 1

Kevin Montrose's concern is that ordinary users will be confused by an entropy meter. That does not justify blocking good passwords, which is what the current system does.

A simple way to satisfy both criteria:

• Calculate entropy in the background. Any password with entropy over some threshold will get accepted.

• Passwords with less entropy than that fall back to the system shown. For example, if someone gives a low-entropy password that contains only letters, it could suggest adding "upper case, numbers, or special characters". To avoid being user-hostile, passwords that meet all the constraints could be accepted (even if they have low entropy).

  You claim that you're using your password criteria to enforce security for OpenID accounts. That's fair—except the current system accepts qwerty1! as a password. Seriously? If you're going to "fall on the strict side" for security, you shouldn't be accepting passwords with 6.322 bits of entropy (according to zxcvbn).

There exist libraries to quickly estimate entropy, such as the one Dropbox uses.

Answer 2

I appreciate that there is no way that this policy is ever going to change based on what I have to say, but it is a good example of listening to your customers needs, and then ignoring them to go off and do something fun instead.

1. Stack Exchange initially only allows login using openid.
2. Lots of people don't like that. We just want to log into a Q&A site and ask a question. We don't want any connection between this site and our gmail account or our facebook account or whatever. Having a single password that if broken allows access to everything about their life doesn't seem more secure to us. It's not even clear whether Stack Exchange will now have access to their gmail or facebook account. Presumable not, but who knows? All we want is to give an email address and password and log into the site to ask a question.
3. Stack Exchange says that the acquisition of new users is a very high priority. The openid thing is deterring users, so they fix it. Hooray, everybody is happy.
4. Especially the developer who, instead of having to so some boring password authentication, gets to play with openid.
5. But the password standard is needlessly zealous. We have an intuitive understanding of when it is important to have a really good password, and sorry but a Q&A site does not make the cut.
6. But the password standard can't be lowered to something more appropriate for a Q&A site, because instead of doing the simple thing and allowing people to log on using an email address and password, Stack Exchange did the fun thing instead with openid.

Now I personally will cope with the password rules because I have seen the effectiveness of stackoverflow.com before, and I need a question answered for work. But I wonder, how many people who stumbled upon Stack Exchange gave up at that first barrier?

So if anybody from Stack Exchange is out there reading, maybe consider the following:

1. Stack Exchange really wants new users.
2. A simple password is sufficient for a Q&A site.
3. The current password system is turning potential new users away at the door.
4. You could fix it if you wanted to.

Answer 3

Stack Exchange username/password accounts are actually OpenIDs, not something tied to the Q&A portion of the network ( https://openid.stackexchange.com/ ).

Because these accounts aren't constrained in use (by design) we can't assume anything about the "importance" of the account, thus the rather stringent password constraints.

What the password contraints are meant to do is act as a "normal person"-readable proxy for entropy.

Directly exposing entropy measurements to a registering user would be absurdly user hostile, and a simple yes/no indicator just begs the question "why isn't my password acceptable?" (you can't just say "not enough bits!").

In short, while you and I (and a non-trivial number of the people reading this, I'd wager) can reason about Shannon entropy the typical end user cannot. The character class stuff is a reasonable approximation that has the benefit of being explainable, and we fall on the more strict side because security is involved.

So no, we won't be relaxing the openid.stackexchange.com password requirements.

Answer 4

Make a two-column table: two-char language codes against a very common word in that language. Randomly pick a row from that table. Ask Google or other search engine "Show me pages in language xxx containing word yyy" Randomly pick one of the the fifth through zzz hits. Randomly pick a word from that page. Repeat. Stick the two words together. Write them on a post-it Stick that on the bottom of your keyboard. Cuss and swear because all the sites only accept ASCII characters.

My problem is that I followed the usual asinine rules exemplified in XKCD for nine characters, and SE said I need one more character. So I invented a new one with ten characters and SE said I need one more character.

UPDATE: One more unique character, i.e., one not yet used. So 5tack-Exch@nge! would probably work :-)

By the way, “gizmo didn't eat chicken after midnight” was accepted. I didn’t try to log in with it, though.

Next experiment: Pasted in two Chinese words separated by a semi-colon. The request was to add one capital letter or digit. Putting a '2' on the end still got the same request.