Password Rules Are Bullshit
I agree with almost everything but the he loses me towards the end:<p>&gt; I had a bit of a sad when I realized that we were perfectly fine with users selecting a 10 character password that was literally &quot;aaaaaaaaaa&quot;. In my opinion, the simplest way to do this is to ensure that there are at least (x) unique characters out of (y) total characters.<p>Isn&#x27;t that exactly what you&#x27;re complaining about with your arbitrary password restrictions to begin with?<p>I mean, I can imagine that a clueless user might have the illusion of safety if they&#x27;re using something like &quot;1q2w3e4r5t&quot; but if I use &quot;aaaaaaaaa&quot; as a password on a website I know full well what I&#x27;m doing. So why even bother?<p>I think there are two possible ways to look at this problem from a service provider perspective:<p>- if the user getting their password stolen is a bad thing <i>for you</i> (i.e., you&#x27;re a bank or something like that, and getting an account compromised will put you in trouble), then IMO the only satisfactory solution is to impose a password to the user. In effect these ridiculous password requirements are exactly that, except less convenient and secure. Cut to the chase and say &quot;your bank password is Axei5aoc0i, write it down somewhere safe&quot;.<p>- if the user getting their password stolen is not a problem for you because it&#x27;s not your responsibility to handle these issues (like a hacker news account for instance) then just let the user pick whatever they want and deal with the consequences. If they care enough about it they&#x27;ll care enough to pick a decent password. At most if you really want to be friendly give an indication that a password might be weak, but please don&#x27;t disallow it.