Ondřej Bárta
1 min readMay 10, 2018

--

This password can be very easily cracked by a dictionary attack. Sure, it'd take longer to brute force than the other, but nobody uses brute force anymore because, as you already wrote, it's very ineffective. Creating a good password can be tricky. And a password like this is not safe. At least please link an article from some security engineer. But I'd be happy if you removed this sentence.

Sometimes those rules are there to actually protect the user and they are very well thought out. But more than often they just restrict how the password should look like, making it easier for a hacker because they already know what to look for (very simple example: if a website requires a number in the password, a hacker already knows to skip tries without a number). That'd be my main issue with password rules, not this thing you wrote.

A person can forget their password, reset password. A person can have trouble entering a password. But once they actually lose the password to someone.. their information can leak and then there's no going back. I believe designers should work with security engineers as well. Pleasure for the user isn't always the most important thing. And a good designer should know this.

--

--

No responses yet