When signing up to Twitter and selecting your password, Twitter bans some passwords although they have the minimal size. These passwords are hard coded in the code, and thus can be consulted (which is not an issue at all).

If you don’t want to reverse engineer code, the full list of 370 bad passwords is published by the Wundercounter.

It is interesting to see them. They are totally logic. Interestingly, this password ban is only for English native speakers. Foreigners can still use stupid passwords. For instance, as expected QWERTY, but also ASDFGH are banned. In france, among the worst passwords, we have AZERTY and QSDFGH due to our specific keyboards.

It is really fun to see the selection. My preferred one is THX1178. How many geeks would use this one? It is an ultimate recognition to be listed with STARWARS and STARTREK.

In any case, it is a good initiative. But internationalisation would be better. Do you know any repository of bad passwords for many languages?

I recently stumbled across a useful site for increasing security awareness. The Password Strength Checker evaluates the submitted password. The use is intuitive.

Sure, when a password is declared as strong, then it is strong. I played a little bit with. I discovered that my Firefox master key was 74%, my account password was 70%, and my password for this blog was only 30%!

When examining the poor result of this last password (rather long), I find that I was not in total agreement with the rationales of the penalties. Consecutive upper case letters, lower case letters or numbers are “penalized”. Intuitively, I would think that systematically you recommend to avoid consecutive upper case, lower case or numbers would give an advantage in brute force. If I select a upper case, then in brute forcing next character, I would avoid to use an upper case. It reduces (slightly) the space of passwords.

Nevertheless, a nice useful tool.

According to Jakob Nielsen, masking password while dialing it is a bad idea. The arguments are that users may make more errors with blind typing, and that due this complexity, they will choose simpler passwords.

Jakob Nielsen is a highly respected guru of usability. When I was working in User Interfaces research (many years ago), I religiously read all his books. I learn a lot. It was my first contacts with human psychology and brain behavior. I’ll soon come back to that interesting topic. Thus, his comments deserve our interest.

His first argument is definitively true. Who had never got his/her password rejected because the cap key was on? A visual feedback would avoid this type of errors. I must confess that each time I have to enter my long passphrase of PGP, I’m nervous. Especially if you are like me keyboard dyslexic. 🙁

I would tend to disagree on the second argument. People mainly choose a simple password because it is more difficult to remember complex passwords, rather than because it is difficult to dial them.

Sometimes, we have forgotten the initial design purpose. Password masking is mainly to avoid shoulder surfing. Shoulder surfing on a mobile device (such as BlackBerry) is far more difficult than on a notebook in an airport. Thus, is it using to protect against this threat on mobile? If there is nobody present for shoulder surfing, why protect against an non existing threat?

Thus, I would rather agree with Jakob Nielsen to mitigate the orthodoxy of password masking with some rules:

• When shoulder surfing is not possible, do not mask (unless you fear screen capture, but then you may also fear key logging)
• Propose a checkbox that would allow to mask/unmask the password. I would suggest that the default state could be masking.

Should we violate this rule?