4 ms·
Key risk with passwords is reuse across differently vulnerable websites/apps. Password complexity enforcement does nothing to address this risk. For many users
by vinay_ys 4y ago
Key risk with passwords is reuse across differently vulnerable websites/apps. Password complexity enforcement does nothing to address this risk. For many users it may actually push them to reuse passwords.
- atoav 4y agoUnless your rules force them not to. E.g. "you are only allowed to use unicode whitespace characters and ancient greek letters". Guarantueed to not be used anywhere else. On a more serious note: enforce minimum length, enforce that it is not in the list of most common passwords, enforce that the password is not their username/email and inform about the risk of password reuse. If an account is hacked because they used "password" as their password they won't care about your argument why it was hacked (and if you did things right you won't know what password they used). So better avoid that class of problem in front.