15

According to this article the password 12345 was the third most popular password in use in the year of 2014. So why does SE use such a weak and commonly used password as a placeholder hint?

According to W3:

placeholder - represents a short hint (a word or short phrase) intended to aid the user with data entry. A hint could be a sample value or a brief description of the expected format.

I think this 12345 password hint could make some users assume that it's no big deal to use a weak password when creating a Stack Exchange account.

So could it be changed to something that resembles something not so weak like 6-8/Hrs||wks||mos||yrS or %UnIcOrN42%? Or maybe even just a short description instead like Create a Strong Password :).

Also, the example placeholder text goes against SE's own requirements/advice in the tooltip of must have upper case, lower case, and numbers or symbols in password with at least 8 unique characters.

So this situation is like lecturing someone to eat healthy food while, at the same time, you place a tray in front of them which holds a double cheezburger, chocolate shake, soda, and french fries.

SE new account sign up form

  • 1
    Using nonsensical placeholders that look nothing like what real content ought to be is kind of a tradition here. – user259867 Aug 1 '15 at 3:41
  • 2
    @NormalHuman: Agreed on the tradition, but note that the complaint is kind of the same in both cases: it actually does look something like real content, except for being almost insanely dumb. And placeholders that rely on people having it together enough to realize how dumb they are seems (to me) like a lousy idea. – Nathan Tuggy Aug 1 '15 at 5:13
  • Agreed. Should be changed to pAs5w0rD. – user642796 Aug 1 '15 at 5:42
  • Whoa. Whoever did this did not think about security. – Deer Hunter Aug 1 '15 at 7:08
  • 2
    It was not our intent to use the third most common password. What's the first? We'll change it to that. – Jaydles Aug 2 '15 at 0:26
  • Jokes aside: You're right - that's dumb! We'll change it. – Jaydles Aug 2 '15 at 0:27
  • @Thomas - might as well post an answer with a screenshot of the new page? – ᔕᖺᘎᕊ Aug 10 '15 at 9:49
  • 1
    @ᔕᖺᘎᕊ Thanks for the ping — got pulled into something and forgot to do so! – Thomas Orozco Aug 10 '15 at 10:12
4

We've updated the signup page; the placeholder text is now ********:

new placeholder for password field

Why *******? There was no "real password" placeholder that felt like the right choice (as was discussed here), but not having one at all wasn't very consistent with the other fields.

Thanks for the report!

6

So could it be changed to something that resembles something not so weak like 6-8/Hrs||wks||mos||yrS or %UnIcOrN42%?

This is arguably less secure.
You argue "12345" is a problem based on the fact users would use it, which means in the same argument users would also use your stronger example.
Especially as it's a stronger looking password, as then even people with a bit of sense who wouldn't use 12345 might use the stronger looking one.

Then it's less secure, as many people share the same password, and it's a public example.

Also, the example placeholder text goes against SE's own requirements/advice in the tooltip of must have upper case, lower case, and numbers or symbols in password with at least 8 unique characters.

In terms of security, the example password being a non-usable example surely makes it less of a problem? It would require an addition of two letters and another character to cater for site requirements for passwords.

While this wouldn't make it necessarily a strong password (i.e. Ab123456) it impedes usage as people would possibly be more likely to make up their own or use a previously used password, than edit and add to the example one.

The resolve

With all of that said, I think the solution is to simply not show anything at all.

Why do we need an example of how to type characters on the internet?

You need characters for your password
This is what characters look like - 12345

This is just pointless.

  • Searching for j. doe at stackoverflow.com/users , it gives 10 users with j. doe as username. Like 3 have signed up 2 days ago, and the other 7 have signed up >= 6 months ago. What does that tell us? IDK. Yea, I think leaving it blank or just description of what to do like "create a strong password here" is the way to go. Or the team could create a random placeholder password generator which would show like a different password every time for placeholder text. – CRABOLO Aug 2 '15 at 7:35
  • I don't think users would literally copy the random-looking password, for the simple fact that it would be really hard to do so. You can't copy and paste from a placeholder, and it disappears as soon as you focus on the field. But if you're really concerned about this, it could generate a random placeholder on the fly, so if the user copies it it will be unique. – Barmar Aug 7 '15 at 2:22
  • @Barmar I don't see the point in having anything - as per my answer. i.e. Why do we need to show users what text looks like in a web form? – James Aug 7 '15 at 12:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .