Blocking few generic passwords for Gmail sign for users

[VickyJ]

Hello Team, 

As an admin we want to have our users to set the passwords that spammers should not guess and hence we wanted to restrict our users not to use few passwords for their email accounts.

Currently there is no options for admins to perform these actions. It would be helpful if Google develops this for the admins.

[jayhlee]

Hi VickyJ,

  Google already prevents users from setting generic pasword like "password" or "123456". You can additionally require users to set a strong password with high entropy:

https://support.google.com/a/answer/139399?hl=en#zippy=%2Cwhat-makes-a-password-strong

[VickyJ]

Hey Team,

Currently Google only blocks weak passwords, like "123456" or "password123".

Considering the same for a domain example.com, there are high chances users
may use passwords like "example123" or "Example123 '' etc which we (as
admins) currently don't have access to restrict.

--
Thanks and Regards:
Vicky J
Webveer Automation and Services

[jayhlee]

Hi Vicky,

  Understood. I believe Google does block some permutations of the user email address and name but have not tested this in some time. Beyond this if you'd like stricter control of user passwords you can configure the SAML SSO change password URL to point to a web service where users can set their password. The service would be responsible for confirming the password meets your organization requirements and then pushing the password to Google using the Directory API.

Additionally I'll add that while strong passwords are helpful in protecting users, even the strongest passwords can be stolen via phishing or key logging. I would encourage you to look at encourage / enforcing two-step verification among your users in order to reduce succesful attacks on your users.

https://support.google.com/a/answer/9176657?hl=en

Jay

[Sapherywa]

Your concern about restricting users from using generic passwords for Gmail accounts is valid for enhancing security. While Google doesn't currently offer this feature for admins, there are proactive steps users can take.
Encouraging users to use a strong (URL Removed by Staff) can help create complex and unique passwords that are harder for spammers to guess.
Additionally, educating users about the importance of password security and recommending best practices, such as avoiding easily guessable passwords and regularly updating passwords, can further enhance account security.

[KAM]

Hi @harriscordan I would politely say that that the concepts you are describing are antiquated in cybersecurity.  Allow me to explain, please.

A few years ago now, NIST updated their digital identity guidelines:

#1 Get rid of password complexity and instead use length - NIST - Digital Identity Guidelines, SP 800-63B Section 5.1.1.2 paragraph 9, “recommends against the use of composition rules (e.g., requiring lower-case, upper-case, digits, and/or special characters) for memorized secrets. These rules provide less benefit than might be expected…”

KAM Tip #1 - use Passphrases not passwords - See https://preshing.com/20110811/xkcd-password-generator/ for some great information

#2 Don’t require periodic password changes - “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.”, SP 800-63B Section 5.1.1.2 paragraph 9

KAM Tip #2 is that anything you have to write down is less secure.  A passphrase like a lyric from your favorite song that is 30 characters long is significantly more secure than a 12 digit character "complex" password AND it's much easier to remember a passphrase.

KAM Tip #3 Embrace MFA like Google's 2SV.  That will stop some 99.9999999% of attacks.

Regards,

KAM