(no title)
lvxferre | 3 years ago
I tried to register with a weak password (on purpose) to check security. It works; four tries and three different errors (capital letters required, special characters required, min length required). However, I feel like a user hitting this issue accidentally would've given up after the third try. Perhaps it could be worth to check for multiple errors at once, and output them all to the user; e.g. "The password must mix case, and contain special characters, and have a minimum length of 8". Just an idea/feedback, mind you.
account42|3 years ago
This one is super annoying. A long password without special characters is not any less secure than a short password with one special character added because it was required.
Better than arbitrary requirements like this would be to estimate the entropy and then just prevent low-entropy passwords (or only tell the user - not everyone needs the same level of security for everything).