What's up with Stack Exchange's stringent password requirements?

Question

Before anyone attempts to close this question as a duplicate, please read this little blurb that shows up at the bottom of every closed duplicate question:

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

That is what I am doing right now.

There are several questions here pertaining to Stack Exchange's excessively complicated password requirements. They require any combination of at least three of the following:

• lowercase letters
• uppercase letters
• numbers
• special characters

And at least eight of the characters have to be unique.

What is the reason for this? This has come up recently because myOpenID has been down for well over 48 hours now. After concluding that they are probably down for the count and will not be coming back this time, I decided to look to other OpenID options. Facebook? No, I don't want to link my SE activity to Facebook because they tell me they want to share information. Yahoo! wants to also share information. Google wants to share information. It's just a Q&A site. Why do I have to go through all this?

Ah, I can create a Stack Exchange account! Sweet! But, wait a minute... they make me come up with a password that's sooooo secure that I have to write it down on a Post-it note where it runs the risk of being discovered. That's a really good idea, isn't it?

The most common response I see from commenters here in regard to why this excessively complicated requirement exists is because "It's not just a Q&A site, but an OpenID provider." So what? All the others are OpenID providers, too, but they don't force extreme password requirements on their users. What's the big deal? Can I get a detailed, sensible, and logical answer on this if nothing else?

So I suppose it's obvious that I am hinting at SE to loosen up these requirements a bit (okay, a lot). What's wrong with ditching the uniqueness requirement and simply requiring a mix/match of any two types of characters? For example, a mix/match of lowercase/number, lowercase/special, number/uppercase, etc? As long as the password contains any combination of two of the four types of characters, it passes. What kind of security is SE going for here when the only way someone can remember it is to write it down or store it in a text file on their PC? Can't we just get some simple Stack Exchange-only authentication that has nothing to do with OpenID that has lax password requirements? After all, if my password is aaaa and my account gets hacked, who's fault is that really?

It appears that no one in the other question posts is interested in fielding any further questions on this topic, so I am bringing it up again.

Answer 1

This question has been analyzed, from a technical perspective, over on IT Security.SE: see Appropriate password requirements for a login (OpenID) service/provider/delegate/thing. (See also Recommended policy on password complexity.)

For instance, I'll highlight my answer, where I argue against going overboard on password restrictions, based upon usability considerations. TLDR: If it's not usable, it's not secure, and putting too many restrictions on passwords leaves a system with poor usability.

I also recommend Kyle Cronin's answer, where he points out the unintended consequences of these requirements: they may cause many people to use other providers, which tend to have weaker password restrictions.

In other words, I agree with you that the requirements feel a bit excessive. I elaborate on why in my answer. I can understand why the StackExchange folks are doing it, and I'm sure their hearts are in the right place and they are doing it to protect their users, but nonetheless I think the current password restrictions are probably counter-productive.

Answer 2

I believe you are misinterpreting the requirements. From the post that Kyle Cronin linked in his comment:

• Must contain 3 of: lower case character, upper case character, number, special character.
• Cannot contain any public account field.
• Must have at least 8 unique characters

You seem to think this means a minimum of 3 of each of those character classes. What it actually means is that you must have at least one character in at least three of the four classes. (and, of course, the minimum 8 distinct characters).

Now that you have edited the requirements down to the actual ones, the answer is that they are a fairly industry-standard set of rules, not a particularly strict one (even less strict than many sites I've come across).

Answer 3

You're misinterpreting the requirements, you only need at least one character from three different character classes and not three characters from all four classes. Additionally there is a minimum number of 8 unique characters.

So 1Madscientist would be a valid password for an SE OpenID account. I personally don't find that too bad. For a short 8 character password requiring some diversity in character classes seems reasonable. It's a bit on the high end for something I would not care about, but anything I care about I would protect with a password that strong anyway.

This policy fails for pass phrases though, and that is something that might be nice to allow users more freedom to choose passwords while still encouraging reasonable strong ones. Something like dropping the character class requirements for passwords longer than 14-16 characters should allow for passphrases without actually lowering the standards. The drawback would be that explaining the specific criteria will get rather complicated and it could confuse users.

Answer 4

It needs:

• At least 8 unique characters total
• Out of the following categories of characters, pick 3 categories and have at least one character from each:
  • Digit
  • Upper case
  • Lower case
  • Special characters

Here is the relevant portion of the client side validation code (from here -- this code may be proprietary):

var minPasswordLength = 8;

var _hasLowerCase = /[a-z]/;
var _hasUpperCase = /[A-Z]/;
var _hasDigit = /\d/;
var _hasNonWord = /(_|[^\w\d])/;
var enforceRules = function () {
    error.detach();

    var pw = password.val().toLowerCase();

    if (pw.length == 0) { return; }

    var hasLower = _hasLowerCase.test(password.val());
    var hasUpper = _hasUpperCase.test(password.val());
    var hasDigit = _hasDigit.test(password.val());
    var hasNonWord = _hasNonWord.test(password.val());
    var charClassCount = 0;

    if (hasLower) charClassCount++;
    if (hasUpper) charClassCount++;
    if (hasDigit) charClassCount++;
    if (hasNonWord) charClassCount++;

    if (charClassCount < 3) {
        var nag = 'Add';
        if (!hasUpper) nag += ' upper case,';
        if (!hasLower) nag += ' lower case,';
        if (!hasDigit) nag += ' numbers,';
        if (!hasNonWord) nag += ' special characters,';

        nag = nag.substr(0, nag.length - 1) + '.';

        nag = nag.replace(/(.*),/, '$1, or');

        error.text(nag);

        password.after(error);
        return;
    }


    var uniqueChars = uniqueCharacters(password.val());

    if (uniqueChars < minPasswordLength) {
        var remaining = minPasswordLength - uniqueChars;

        error.text('Must contain at least ' + remaining + ' more unique characters.');

        password.after(error);
        return;
    }

    // don't bother enforcing this until the password is actually *good*
    mustMatch();
};