News for hackers. Stuff that matters.
Re:Authentication Cheat Sheet by M4v3R on Monday February 02, 2015 @11:18AM (#8984904)
I agree on that as well. Enforced - NO (only minimum length should be enforced imho). Encouraged - Yes. Just show a good password strength meter to the user and fine-tune it to your security requirements.

If you enforce all kinds of weird password rules to the user, he will have to write the password down somewhere, because one couldn't possible remember all passwords. And for non-technical users that means some random pieces of paper or post-it notes. On the other hand, encouraging them to come up with something that is strong makes it more likely that they will invent a password that they can remember, thus making it more secure.

Re:Authentication Cheat Sheet by sarciszewski on Monday February 02, 2015 @11:31AM (#8984997)
"Just show a good password strength meter to the user and fine-tune it to your security requirements."

That's the approach I follow in my projects.

I offer a Javascript (window.crypto powered) Diceware passphrase generator and use zxcvbn to let users know the relative strength of the password they've supplied.

I've also been planning an experiment to see if the width of a password field results in users choosing longer passwords, because more empty space. :)

Re:Authentication Cheat Sheet by AceJohnny2 on Monday February 02, 2015 @11:34AM (#8985012)
> If you enforce all kinds of weird password rules to the user, he will have to write the password down somewhere, because one couldn't possible remember all passwords.

I'm going to use the appeal to authority argument, and bring over Schneier to argue that writing your passwords down isn't bad: https://www.schneier.com/blog/archives/2005/06/write_down_yo... (and others posts since, google "schneier writing passwords down" or something)

Remembering your password isn't necessarily more secure, especially since it easily leads to password re-use, which is even worse.