I apologize for this off-topic post, but I hope it will be read by as many moderators as possible: I just wanted to register on Stack Overflow, to be able to leave ratings, etc.

I didn't end up registering because I got so fed up by the password policy. I'd have expected more of the administrators of this site than such silly crypto-nerd behaviour (http://xkcd.com/538/). Honestly, eight unique characters, upper case, lower case, digits, special characters: Who is going to remember that? The result is only that people either use the same password for everything or write it on a post-it next to their screen. And it's going be saved in the browser, anyway. Apart from that, this is a web forum, for God's sake, not a CIA database.

It's the same at my university. Guess what, a third of their email accounts got compromised recently by a phishing attack. People tell you their passwords if you ask nicely.

Do us a favor and don't overcomplicate password protection. It actually reduces security, and annoys me.

  • 2
    +1, i hate it when I have to come up with complicated passwords...Just make a a minimum 8 and that it.
    – user159140
    Jul 2 '11 at 22:15
  • 3
    You can register with your Gmail account even, if you have one
    – Rahul
    Jul 2 '11 at 22:18
  • 3
    I use an OpenID login with a ridiculously simple password. How's that for security?
    – omrib
    Jul 2 '11 at 22:23
  • 2
    It's called Keepass. Use it, learn it, love it. Jul 2 '11 at 23:12
  • If you don't like StackExchange OpenID you can use any OpenID provider of your choice or Google or Facebook or Yahoo. You have other possibility, use them if your not happy with the first one.
    – HoLyVieR
    Jul 2 '11 at 23:47
  • +1, mostly for "People tell you their passwords if you ask nicely.".
    – sarnold
    Jul 2 '11 at 23:53
  • IUseAPassPhrase2!! --pretty simple when you think about it and length is rarely an issue.
    – tvanfosson
    Jul 3 '11 at 1:11
  • Where did you get 'unique' from? I can't make it ask me for unique characters. Like Jeff says below, it accepts Password1 (which has two ss)
    – AakashM
    Jul 3 '11 at 19:55
  • I get the "unique" complaint for a password that is all lowercase letters with one letter repeated. No, it is not "password".
    – starblue
    Jul 13 '11 at 12:15
  • 1
    +1 I'm annoyed by this policy, it is overly strict for logging onto forum sites. Background: I wanted to switch from Myopenid, which is currently down.
    – starblue
    Jul 13 '11 at 12:19
  • +1 I always construct passwords using a sentence and then change some letters into digits and special characters. As a linux system administrator I actually have about 30 passwords like that. Here however I made more than 6 tries, none of which worked, which made me finally resort to "abcABC123!@#", one of the most insecure passwords I ever had in my whole life (but probably a choice of many casual users of this site frustrated with the password restriction here). To require more than a certain length and at least 1 occurrence of characters in 2 different characters classes is simply too much. Sep 1 '11 at 6:44
  • 1
    +1 Me too hate it. I check my history, I've changed my password almost 7 times within a span of 1 year. And I don't want to login using any of the OpenID options available.
    – krishnajay
    Feb 18 '13 at 4:46

If you already have a Yahoo or Google account, it's very simple to login using one of those accounts. Just choose the appropriate icon in the login page, and put in your usual login information.

People writing down passwords because they can't remember them is a human failing, and should not be an excuse for using insecure passwords. Find a mnemonic system that can help you remember your passwords, or swap out some of the numbers or letters for symbols (replacing E with & and A with @, for example).

  • @Keoki: Um, they're all OpenID, including the Yahoo and Google options... Jul 2 '11 at 22:41
  • @Nicholas I didn't read the answer carefully, I thought he was just saying to create an account using new username and password.
    – user163250
    Jul 2 '11 at 22:44
  • > "... is a human failing" -- "human failure" is an indication of a poorly designed system. (cite Don Norman) Mar 4 '15 at 16:39
  • Yeah, but no. There's no point in swapping A for @.
    – Clément
    Aug 4 '17 at 10:33

The browser will indeed remember the password when you log in with Stack Exchange credentials (or at least, it's supposed to).

The reason the password requirements are what they are, is because the SE credentials are re-usable elsewhere on the web as a standard OpenID:


Of course you don't have to use them that way, but they work.

And for the record "Password1" is a valid password under these rules (don't believe me, try it -- I just did!) so it's not like they are that strict.

  • 16
    The problem is not that they are strict, but that they are arbitrary. "Password1" is valid, but "kejkld%&#dswilk" is not.
    – user157130
    Jul 30 '11 at 22:22
  • I don't understand this part: The reason the password requirements are what they are, is because the SE credentials are re-usable elsewhere on the web as a standard OpenID. Are credentials from other OpenID providers not also reusable? They don't have excessively complicated password requirements. Why does SE? Jul 6 '13 at 22:21
  • 8 characters (not necessarily all unique) from 3 of the 4 character categories has always worked for me (and for other OpenID password requirements -- my usual password is always rated as quite strong on those sites that show a password rating meter), so I question the need for the addition of the uniqueness requirement for the SE OpenIDs, given that all OpenID login credentials are re-usable elsewhere on the web as a standard OpenID.
    – RobH
    Sep 3 '13 at 17:03