Gain insights into crafting product password policies that are compliant, secure, and user-friendly, with Logto ensuring the security of your authentication process.
In your product, it's likely that you'll need to rely on the classic authentication method – passwords. While passwords won't be replaced entirely, they are more vulnerable to attacks compared to alternative authentication methods. Are your password policies genuinely secure and compliant? Even if you're familiar with various password policy techniques, is layering them really effective?
We address the complexity of password policy design and configuration by conducting in-depth research on NIST specifications, examining leading product password policies, and ensuring a balanced user experience. Emphasizing the importance of password compliance, we aim to relieve you of the challenges associated with password strategy and provide a comprehensive process for ensuring account security through the seamless integration of passwords with other Multi-Factor Authentication (MFA) verification factors.
Product designers often grapple with the question of whether their products are secure enough, leading to the implementation of strict and complex password policies. For instance, requiring a combination of uppercase and lowercase letters, numbers, and even special characters, or mandating regular password changes for employees.
When faced with such password requirements, users are quick to voice their complaints: "Why does it have to be so complicated? Remembering my passwords feels like a full-time job!” This leaves product managers scratching their heads, wondering if a more complex password policy is necessarily better. Let's break down the components of a comprehensive password policy to find out.
In the next section, we'll delve deeper into the nuances of password policies, striking a balance between security and user convenience. We'll explore how to define the right password requirements and provide data-backed insights to support our approach.
First, after analyzing numerous products and NIST specifications, we've compiled a comprehensive list of password factors and design recommendations.
We've roughly categorized them into three groups:
| Catalog | Factors | Analysis |
|---|---|---|
| Setting password requirements | Length | Increasing password length is more effective in deterring password cracking than complexity. NIST suggests at least 8 characters in length, but longer passwords should be allowed. |
| Character types | Passwords can support various character types, including Uppercase letters, Lowercase letters, Numbers, Symbols, and Unicode (Space characters should also be allowed). | |
| Password policies SHALL NOT prompt users to recall specific types of information, as this has been shown to increase complexity without effectively enhancing security. | ||
| Low-security phrases | It is advisable to prompt users to change their passwords when they use easily guessable or crackable patterns such as repetitive or sequential characters, common words, user information, or product context information. | |
| Breached password | New user passwords should be checked against a list of leaked passwords to ensure they are not compromised. | |
| Password security monitoring | Password verification rate-limiting | Limit the number of consecutive incorrect password attempts. When this limit is reached, implement security measures such as requiring Multi-Factor Authentication (MFA), sending push notifications, imposing cooldown times, or even temporarily suspending the account. |
| Force to change password | Passwords SHOULD NOT be required to be changed arbitrarily. However, verifiers SHALL force a password change if there is evidence of a compromised authenticator. | |
| Password history | Maintain a record of past passwords that cannot be reused. Excessive restrictions on password reuse are not recommended, as users may bypass this rule through minor modifications. | |
| Clear session after changing password | Allow users to choose whether to sign out of other devices after changing their password. | |
| Password entry experience | Password strength meters | Offer guidance to users to help them select strong memorized secrets. |
| Password prompt | Avoid displaying password hints, as they increase the likelihood of unauthorized access. | |
| Copy and paste the password | Permit the use of the "paste" functionality, which facilitates the use of password managers. | |
| View password | Provide an option to display the password as entered, rather than displaying a series of dots or asterisks, until it is submitted. |
Perhaps you don't have the patience to go through every item on the checklist. If we were to design a powerful password tool that encompasses all these configuration options, it might become a headache for developers, even more complex than the complex password policies themselves. Therefore, let's further simplify the password factors into three steps.
As mentioned in the table, some outdated password rules may seem to enhance security but offer little in return, often causing frustration and confusion among users.
We offer flexible configuration options for minimum password policies, with recommended values to reduce the learning curve for developers and provide out-of-box Sign-in Experience. These options include:
For parameters that cannot be customized, we have implemented backup logic to ensure password security. If you have specific customization requirements, please feel free to inform us.
With these three straightforward steps, you can streamline the process of configuring your password experience, striking the right balance between security and user convenience. Logto makes it easy to set up a secure and user-friendly authentication system for your product. Stay tuned for our upcoming MFA feature, and take control of your product's security like never before.