Must passwords be hard?

I just bailed on a registration that was required to buy a book that looked nice. I bailed when I got this message: "Password must be at least 6 characters long, and contain at least one alphabetic and one numeric character." My standard e-commerce web password has six characters in it but only alphabetic. I can't handle coming up with yet another password or remembering which password I used to register for which site. Can't do it. So Pictopia.com just lost a sale for sfgate. (Nice looking book called "Mystical San Francisco". Maybe I'll get it in a book store, which doesn't require any kind of password at all!)

What dumb nerd thought that that particular site needed to enforce a different password format. What the heck is so important about Pictopia's products that it needs to be a pain in the keister to its customers to achieve "better" security.

Comments

[Jim Forbes]

Stew,
In the last 12 months, I've bailed on four sites that require I use their formula for passwords.
I know i'm cranky, but any site that introduces some insane password convention deserves to die.
This is one of my pet peeves.
regards,
jim

[Mark Liebman]

Stewart and Jim,
I'm sorry that you were frustrated at our website. You're likely not the first people who have been frustrated by this requirement. If you like you can order over the phone from us any weekday with NO password. Call us at 510-658-6500, and you will reach our professional staff in Emeryville.

As for password formulas to give yourselves some ease without sacrificing too much of a level of protection, we're open to suggestions.

Cheers,
Mark

[David Tommela]

Yes - passwords must be hard. Otherwise you wouldn't experience that spark of joy when your 75th attempt is the one that works.

Things that are difficult to achieve provide a moment to savor when success occurs. Marriage is an example. Or getting the electrical system to function on older English cars. And then there is Windows of course.