Mixing
Why don't Twitter and Facebook enforce password complexity during sign up?
Clash Royale CLAN TAG#URR8PPP
up vote
2
down vote
favorite
If you try creating an account using your smartphone, these platforms don't seem to have strong password requirements. They both enforce a minimum 6 character limit and nothing else (I did however notice Twitter seems to filter out certain passwords like 111111 whereas this is a legitimate password on Facebook).
I can understand that enforcing strict rules such as uppercase, lowercase, number, and symbol can frustrate users and make passwords less memorable. However, I'm not convinced how the current password validation (or lack thereof) is a better choice.
If I'm creating a new app now, how should I approach this problem?
passwords password-policy facebook twitter
asked 33 mins ago
user246392
1112
New contributor
user246392 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |Â
up vote
2
down vote
favorite
If you try creating an account using your smartphone, these platforms don't seem to have strong password requirements. They both enforce a minimum 6 character limit and nothing else (I did however notice Twitter seems to filter out certain passwords like 111111 whereas this is a legitimate password on Facebook).
I can understand that enforcing strict rules such as uppercase, lowercase, number, and symbol can frustrate users and make passwords less memorable. However, I'm not convinced how the current password validation (or lack thereof) is a better choice.
If I'm creating a new app now, how should I approach this problem?
passwords password-policy facebook twitter
asked 33 mins ago
user246392
1112
New contributor
user246392 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
related: Facebook allows password + any character, Facebook password lowercase and uppercase.
– Steffen Ullrich
22 mins ago
The question is not clear: in the title you ask why Facebook and Twitter allow lax passwords. In the question instead you ultimately ask how you should handle password complexity in your own application. Please align title and question to show what you really want to know.
– Steffen Ullrich
20 mins ago
Possible duplicate of what are good requirements for a password, Recommended policy on password complexity, Are password complexity rules counterproductive?, Why do password strength requirements exist?.
– Steffen Ullrich
18 mins ago
add a comment |Â
up vote
2
down vote
favorite
up vote
2
down vote
favorite
If you try creating an account using your smartphone, these platforms don't seem to have strong password requirements. They both enforce a minimum 6 character limit and nothing else (I did however notice Twitter seems to filter out certain passwords like 111111 whereas this is a legitimate password on Facebook).
I can understand that enforcing strict rules such as uppercase, lowercase, number, and symbol can frustrate users and make passwords less memorable. However, I'm not convinced how the current password validation (or lack thereof) is a better choice.
If I'm creating a new app now, how should I approach this problem?
passwords password-policy facebook twitter
asked 33 mins ago
user246392
1112
New contributor
user246392 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
If you try creating an account using your smartphone, these platforms don't seem to have strong password requirements. They both enforce a minimum 6 character limit and nothing else (I did however notice Twitter seems to filter out certain passwords like 111111 whereas this is a legitimate password on Facebook).
I can understand that enforcing strict rules such as uppercase, lowercase, number, and symbol can frustrate users and make passwords less memorable. However, I'm not convinced how the current password validation (or lack thereof) is a better choice.
If I'm creating a new app now, how should I approach this problem?
passwords password-policy facebook twitter
passwords password-policy facebook twitter
asked 33 mins ago
user246392
1112
New contributor
user246392 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 33 mins ago
user246392
1112
New contributor
user246392 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 33 mins ago
user246392
1112
New contributor
user246392 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
asked 33 mins ago
user246392
1112
asked 33 mins ago
user246392
1112
1112
New contributor
user246392 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
user246392 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
user246392 is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
related: Facebook allows password + any character, Facebook password lowercase and uppercase.
– Steffen Ullrich
22 mins ago
The question is not clear: in the title you ask why Facebook and Twitter allow lax passwords. In the question instead you ultimately ask how you should handle password complexity in your own application. Please align title and question to show what you really want to know.
– Steffen Ullrich
20 mins ago
Possible duplicate of what are good requirements for a password, Recommended policy on password complexity, Are password complexity rules counterproductive?, Why do password strength requirements exist?.
– Steffen Ullrich
18 mins ago
add a comment |Â
related: Facebook allows password + any character, Facebook password lowercase and uppercase.
– Steffen Ullrich
22 mins ago
The question is not clear: in the title you ask why Facebook and Twitter allow lax passwords. In the question instead you ultimately ask how you should handle password complexity in your own application. Please align title and question to show what you really want to know.
– Steffen Ullrich
20 mins ago
Possible duplicate of what are good requirements for a password, Recommended policy on password complexity, Are password complexity rules counterproductive?, Why do password strength requirements exist?.
– Steffen Ullrich
18 mins ago
related: Facebook allows password + any character, Facebook password lowercase and uppercase.
– Steffen Ullrich
22 mins ago
related: Facebook allows password + any character, Facebook password lowercase and uppercase.
– Steffen Ullrich
22 mins ago
The question is not clear: in the title you ask why Facebook and Twitter allow lax passwords. In the question instead you ultimately ask how you should handle password complexity in your own application. Please align title and question to show what you really want to know.
– Steffen Ullrich
20 mins ago
The question is not clear: in the title you ask why Facebook and Twitter allow lax passwords. In the question instead you ultimately ask how you should handle password complexity in your own application. Please align title and question to show what you really want to know.
– Steffen Ullrich
20 mins ago
Possible duplicate of what are good requirements for a password, Recommended policy on password complexity, Are password complexity rules counterproductive?, Why do password strength requirements exist?.
– Steffen Ullrich
18 mins ago
Possible duplicate of what are good requirements for a password, Recommended policy on password complexity, Are password complexity rules counterproductive?, Why do password strength requirements exist?.
– Steffen Ullrich
18 mins ago
add a comment |Â
1 Answer
1
active
oldest
votes
up vote
2
down vote
Facebook and Twitter have very...specific, controversial security postures. They serve a broad market and the security space does not always appreciate everything they do. My recommendation for an app you're building might be not to follow Facebook and Twitter's examples in terms of security.
For resources, I recommend looking to OWASP first. If you're not familiar with OWASP, they're a collection of application security methods and best practices, giving visibility on the whole lifecycle - from conception and design through to pentesting. They lead the appsec industry and speak with a huge amount of (well-earned) authority.
All that being said, definitely checkout OWASP's information on password strength controls. If you're looking for help with password strength implementation, hopefully that should sort you out. (And while you're there, have a look at the OWASP top 10 for other helpful tips when it comes to building your app.)
Great question by the way. Good luck with the app!
answered 23 mins ago
BoggleSmalls
764
add a comment |Â
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
2
down vote
Facebook and Twitter have very...specific, controversial security postures. They serve a broad market and the security space does not always appreciate everything they do. My recommendation for an app you're building might be not to follow Facebook and Twitter's examples in terms of security.
For resources, I recommend looking to OWASP first. If you're not familiar with OWASP, they're a collection of application security methods and best practices, giving visibility on the whole lifecycle - from conception and design through to pentesting. They lead the appsec industry and speak with a huge amount of (well-earned) authority.
All that being said, definitely checkout OWASP's information on password strength controls. If you're looking for help with password strength implementation, hopefully that should sort you out. (And while you're there, have a look at the OWASP top 10 for other helpful tips when it comes to building your app.)
Great question by the way. Good luck with the app!
answered 23 mins ago
BoggleSmalls
764
add a comment |Â
up vote
2
down vote
Facebook and Twitter have very...specific, controversial security postures. They serve a broad market and the security space does not always appreciate everything they do. My recommendation for an app you're building might be not to follow Facebook and Twitter's examples in terms of security.
For resources, I recommend looking to OWASP first. If you're not familiar with OWASP, they're a collection of application security methods and best practices, giving visibility on the whole lifecycle - from conception and design through to pentesting. They lead the appsec industry and speak with a huge amount of (well-earned) authority.
All that being said, definitely checkout OWASP's information on password strength controls. If you're looking for help with password strength implementation, hopefully that should sort you out. (And while you're there, have a look at the OWASP top 10 for other helpful tips when it comes to building your app.)
Great question by the way. Good luck with the app!
answered 23 mins ago
BoggleSmalls
764
add a comment |Â
up vote
2
down vote
up vote
2
down vote
Facebook and Twitter have very...specific, controversial security postures. They serve a broad market and the security space does not always appreciate everything they do. My recommendation for an app you're building might be not to follow Facebook and Twitter's examples in terms of security.
For resources, I recommend looking to OWASP first. If you're not familiar with OWASP, they're a collection of application security methods and best practices, giving visibility on the whole lifecycle - from conception and design through to pentesting. They lead the appsec industry and speak with a huge amount of (well-earned) authority.
All that being said, definitely checkout OWASP's information on password strength controls. If you're looking for help with password strength implementation, hopefully that should sort you out. (And while you're there, have a look at the OWASP top 10 for other helpful tips when it comes to building your app.)
Great question by the way. Good luck with the app!
answered 23 mins ago
BoggleSmalls
764
Facebook and Twitter have very...specific, controversial security postures. They serve a broad market and the security space does not always appreciate everything they do. My recommendation for an app you're building might be not to follow Facebook and Twitter's examples in terms of security.
For resources, I recommend looking to OWASP first. If you're not familiar with OWASP, they're a collection of application security methods and best practices, giving visibility on the whole lifecycle - from conception and design through to pentesting. They lead the appsec industry and speak with a huge amount of (well-earned) authority.
All that being said, definitely checkout OWASP's information on password strength controls. If you're looking for help with password strength implementation, hopefully that should sort you out. (And while you're there, have a look at the OWASP top 10 for other helpful tips when it comes to building your app.)
Great question by the way. Good luck with the app!
answered 23 mins ago
BoggleSmalls
764
answered 23 mins ago
BoggleSmalls
764
answered 23 mins ago
BoggleSmalls
764
answered 23 mins ago
BoggleSmalls
764
764
add a comment |Â
add a comment |Â
user246392 is a new contributor. Be nice, and check out our Code of Conduct.
user246392 is a new contributor. Be nice, and check out our Code of Conduct.
user246392 is a new contributor. Be nice, and check out our Code of Conduct.
user246392 is a new contributor. Be nice, and check out our Code of Conduct.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f196989%2fwhy-dont-twitter-and-facebook-enforce-password-complexity-during-sign-up%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
related: Facebook allows password + any character, Facebook password lowercase and uppercase.
– Steffen Ullrich
22 mins ago
The question is not clear: in the title you ask why Facebook and Twitter allow lax passwords. In the question instead you ultimately ask how you should handle password complexity in your own application. Please align title and question to show what you really want to know.
– Steffen Ullrich
20 mins ago
Possible duplicate of what are good requirements for a password, Recommended policy on password complexity, Are password complexity rules counterproductive?, Why do password strength requirements exist?.
– Steffen Ullrich
18 mins ago