3 ms·
Make it easier for would be attackers. If someone knows the minimum requirements are 8 characters, alphanumeric, with one capital chances are the majority of u
by wazanator 10y ago
Make it easier for would be attackers.
If someone knows the minimum requirements are 8 characters, alphanumeric, with one capital chances are the majority of users are using that minimum.
Add to this most people use easy to remember and common passwords one wouldn't need to brute force every possible combination just the most likely combinations. If someone is brute forcing and they can't get it by just going through a list of the most common they will probably just stop and move on to the next user. Attackers are not often after one user they are just trying to get the easiest ones.
- jklein11 10y agoI think the OP addresses this in his second paragraph. In the case where registering is open for the public, it is trivial for a would be attacker to find the password requirements. They only need to go through registration to find the password complexity. This means that you are incurring a usability cost with out a security gain. One limitation of showing the requirements at log in I could think of is that it would require all users to have the same password requirements. This is just a thought, but if the password requirements were random throughout the userbase, it would make it more difficult for your users to use the same password across different sites. For example, if you require 25% of your users to have two capital letters, 25% have 2 symbols .. etc, it is less likely they would have gotten the same requirement from a different site.