Im sure you've all tried to enter in a password that was too short when registering for a website. My favourite password is five characters long and i HATE being asked to enter one at least 6-8 characters long.
Dont get me wrong, I understand the concept for important things, such as online bank accounts or anything with important personal information. I have a secure usb flash drive where i keep important documents with 128bit encryption and my password for that is a 10 char mixture of numbers, letters and special characters.
However, when i want to sign up to a stupid website forum, where the only information being protected is my real name and email address (assuming i entered real details) it makes little sense to enforce high security. Besides which, if someone really wanted to access my account on a forum there are much easier ways of doing it. Chances are i could exploit a security flaw in the CMS or hosting environment
What about brute force attacks? password lengths minimums are intended to increase the possible combinations of the password, with each extra character exponentially increasing the time required to try all the possible combinations. Brute force hacking on the web is much slower than a locally run application, each attempt is a full postback taking potentially a few seconds. Chances are the amount of attempts required on even a 5 char password would be enough to fire off warning signs to your ISP form denial of service attack or irregular use.
Length has nothing to do with personal referenced passwords, if i used my dogs name aand you guess it because i know you IRL or something then it wouldnt matter if its was 15 chars or 2 because you bypassed the guessing process.
So if you own a website that requires registration consider the value of the information you're storing and the ease of alterative access methods before SACRAFICING USABILITY of your website. If someone cant remember their login because they've been forced to make a new one, then if they do come back (and presumably you want them to) theyre not going to be able to login until theyve requested a new one and waited for 15 minutes for the email to arrive. All of which translates to a negative experience stacked against you.
PS: Trying to register for DNN prompted this post. 