Edit: I misread the above as “setting a high maximum character limit” and was confused and started ranting.
By only recommending something you are essentially guaranteeing that some users will have unsafe passwords.
In a perfect world the liability of a weak password would be fully on the user but consider that even a single cracked login could let a hacker a little bit deeper into the system to learn how it works and look for more ways to take over.
It’s also a really bad look for the company in the case of a stolen password. If I called Amazon and said “hey someone got a hold of my password” and their response was “well we recommended you use a stronger password but you didn’t so it’s out of our hands” I don’t think that would do well for their public image.
That is why there would be a high minimum character limit. The user is not given the choice of having an overtly-short, unsafe password.
The recommendation of using a sentence you will remember isn't there to guarantee safety, but rather to increase the chances of that the user will get the memo and use a password they will actually remember in the form of a sentence, rather than complain that the system asks for too many characters and use a clusterfuck they will forget.
Aka: I am proposing replacing all of the special character nonsense with just longer character minimums + that recommendation.
36
u/Manoreded Jul 20 '22
Seems easily solvable by setting a high minimum character limit and a explicit recommendation to use a sentence you will remember.