[Suggestion]: Stop enforcing password complexity

[jeanscherf]

Feature Description

I'd say please stop enforcing password complexity.

There are a bunch of articles saying that it is not great to use this, e.g. https://www.starlab.io/blog/why-enforced-password-complexity-is-worse-for-security-and-what-to-do-about-it

I wanted to try cosmos just internally, nothing exposed.

[azukaar]

This article is COMPLETELY wrong on every points. I dont want to spend time going point by point but

• Rate limiting / locking accounts is not enough, as leaked database would leak the hashed password and not be rate limited (other than hardware capability)
• Even if adding numbers / special chars lead to patterns (such as password123) it still forces brute forcer to test for those characters, leading to many more guesses needed before finding a password (as opposed to only trying A-Z)
• MFAs is not enforced by default and would induce MORE frictions than strong password if it was
• "it actually makes brute-forcing easier, since we are now artificially establishing a floor to begin our password guesses" this is wrong, because a password with 3 AZ characters is 17k possibilities, but 6 is 300M. Even if we establish a floor, we only discarded less than 100M possible passwords (fromo 1 to 5 chars), which is a sum of less possibilities than 6 characters passwords alone
• Additioanl characters also mitigate dictionnary attacks because people tend to do things like someW0rds meaning that "some words" would take many guesses to do right

I didnt read the rest of the article but I hope this is enough to justify that the article is erroneous, and should not be referenced