Your blog post says:
> "Avoid using simple passwords based on dictionary words"
And yet your password algorithm rejects highly secure pass phrases:
> "New passwords can contain letters, numbers and punctuation."
Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation demand.
It gets worse.
If I type a long sentence without spaces such as "thisphraseisdefinitelynotinthedictionary", you give me an orange warning checkmark and suggest:
> "Try using a combination of letters and numbers"
If I replace that long phrase with "abcde1", just 5 lowercase letters and a digit, you give me a green checkmark! Same green checkmark for "abc123", the third most popular password online.
Have whoever wrote your validator needs to go read http://xkcd.com/936/ and really internalize the idea.
EDIT: See also:
1. How people choose passwords: http://www.troyhunt.com/2011/07/science-of-password-selectio...
2. Top 25 passwords: http://www.prweb.com/releases/2012/10/prweb10046001.htm
3. Twitter banned passwords: http://securitywatch.pcmag.com/none/284196-the-twitter-banne...
> "Avoid using simple passwords based on dictionary words"
And yet your password algorithm rejects highly secure pass phrases:
> "New passwords can contain letters, numbers and punctuation."
Disallowing spaces is particularly annoying for a company with a strong security requirement, as passphrases are simultaneously far more secure and far more memorable than the monkey rules your validation demand.
It gets worse.
If I type a long sentence without spaces such as "thisphraseisdefinitelynotinthedictionary", you give me an orange warning checkmark and suggest:
> "Try using a combination of letters and numbers"
If I replace that long phrase with "abcde1", just 5 lowercase letters and a digit, you give me a green checkmark! Same green checkmark for "abc123", the third most popular password online.
Have whoever wrote your validator needs to go read http://xkcd.com/936/ and really internalize the idea.
EDIT: See also:
1. How people choose passwords: http://www.troyhunt.com/2011/07/science-of-password-selectio...
2. Top 25 passwords: http://www.prweb.com/releases/2012/10/prweb10046001.htm
3. Twitter banned passwords: http://securitywatch.pcmag.com/none/284196-the-twitter-banne...