Password length & complexity
A password is something that a user knows similar to a personal identification number (PIN) we use for our bank's ATM card. Coupled with user identification, it the most common form of identification and authorization mechanism implemented in web applications. Below are advantages and disadvantages on using a password as authentication mechanism.
- easy to implement
- inexpensive (doesn't require sophisticated hardware
- easy to use (unless you forget it)
- easy to guess
- can be sniffed or brute forced
- users tend to forget their password or list them on sticky notes posted in their monitor or under the keyboard
With best practices and proper implementation guidelines, the use of password as an authentication mechanism can be a quick and easy solution.
Password length and complexity with proper password management makes the use of password as an authentication mechanism worthwhile to consider in your web application requirements. Below are best practices for password length and complexity.
- Minimum length of password should be eight (8) characters long.
- Password characters should be a combination of alphanumeric characters.