Before anyone attempts to close this question as a duplicate, please read this little blurb that shows up at the bottom of every closed duplicate question:
This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.
That is what I am doing right now.
There are several questions here pertaining to Stack Exchange's excessively complicated password requirements. They require any combination of at least three of the following:
- lowercase letters
- uppercase letters
- numbers
- special characters
And at least eight of the characters have to be unique.
What is the reason for this? This has come up recently because myOpenID has been down for well over 48 hours now. After concluding that they are probably down for the count and will not be coming back this time, I decided to look to other OpenID options. Facebook? No, I don't want to link my SE activity to Facebook because they tell me they want to share information. Yahoo! wants to also share information. Google wants to share information. It's just a Q&A site. Why do I have to go through all this?
Ah, I can create a Stack Exchange account! Sweet! But, wait a minute... they make me come up with a password that's sooooo secure that I have to write it down on a Post-it note where it runs the risk of being discovered. That's a really good idea, isn't it?
The most common response I see from commenters here in regard to why this excessively complicated requirement exists is because "It's not just a Q&A site, but an OpenID provider." So what? All the others are OpenID providers, too, but they don't force extreme password requirements on their users. What's the big deal? Can I get a detailed, sensible, and logical answer on this if nothing else?
So I suppose it's obvious that I am hinting at SE to loosen up these requirements a bit (okay, a lot). What's wrong with ditching the uniqueness requirement and simply requiring a mix/match of any two types of characters? For example, a mix/match of lowercase/number, lowercase/special, number/uppercase, etc? As long as the password contains any combination of two of the four types of characters, it passes. What kind of security is SE going for here when the only way someone can remember it is to write it down or store it in a text file on their PC? Can't we just get some simple Stack Exchange-only authentication that has nothing to do with OpenID that has lax password requirements? After all, if my password is aaaa
and my account gets hacked, who's fault is that really?
It appears that no one in the other question posts is interested in fielding any further questions on this topic, so I am bringing it up again.
aaaa
, who's fault is it that it gets compromised?nb4 xkcd
at the end of my post.abcABC123!@#
? Also, public opinion may blame the provider? Are you suggesting the provider could get sued? My bank doesn't even allow special characters in the password. Debit card PINs are only 4 digits. Who's at risk of liability here? Edit: Also see part of my post where I mention SE-only authentication that doesn't rely on OpenID.