Password Rules Are Bullshit

Surely that's a cop-out? If the user getting their data stolen is not a big deal for you, why bother securing any system at all?

The reason service providers set password rules is because there are many, many people who do not understand what a good password is, or the risks associated with losing them. There are people out there using the same password for everything, unaware that the compromise of one service can spell doom for their financial life.

Developers really need to start taking responsibility for their code. Setting password rules, while arbitrary, are about protecting users. This may upset those who are tech-savvy and know what they are doing, but that really weighs nothing compared to the benefits it brings to those who are not.

I see. If that wasn't a design goal, this construction is sound.

I asked Keepass for another password; it included special characters, was 24 chars long and "very strong", according to the website. Rejected.

I then noticed that the message was telling me I could not have more than 16 characters, so I trimmed the password to something rated as "medium". Accepted.

So yes, password rules are bullshit.

Password reuse across sites. Have some check as to whether the same password can be used for the same username / email across other sites. I discovered this one early; back in 2000 I was an admin for a student portal at uni created by Virgin. As an admin I could manage people's accounts; including reset their passwords. The field for me to change their password had their current password; it was hidden by asterisks so I couldn't see it... until I clicked view source on the site :/. So now I had everyone's passwords & their email addresses; my guess is I could have taken advantage of this for at least 80% of those accounts.

Password change frequency. Changing your password can be annoying; but there is some benefit (so long as you're not changing too often).

Password reset rules. If you click "forgot password", many sites still use the memorable question with questions which are often publicly available (e.g. to get someone's mother's maiden name, this information's on the public record, and can often be found through someone's social media too by looking through their contacts, then the contacts of those sharing their surname; as their mother's maiden name will match their uncle's surname, and most people with their surname will be friends with both their mother and their uncle). Emailing a reset link is great; but relies on email which isn't (and some people's mail's very unsecure; e.g. company mail can often be legitimately viewed by the company's IT team; and that's the non-hacky scenario).

"COMMON PASSWORD: IN THE TOP 9635 MOST USED PASSWORDS

Your password is very commonly used. It would be cracked almost instantly[1]"

I do realise there's a difference between cracking a local system password vs a website password but always assume a site's database is going to be leaked at some point

[1] https://howsecureismypassword.net/ (Don't go putting real passwords in there..)