Right, but if they want to prevent against that type of attack, they just have to download some "popular 8-10 character password dictionary" and check if the person's password is there.
If a password is not in a common password dictionary, it's just as secure as any other password with the same length and types of characters. If nobody has ever used the password "nOOlnml9" before, it's a good password, even though there is some pattern and repetition of characters.
The restrictions on that site scream out that whoever made them doesn't know the first thing about cracking passwords, much less how to stop people from doing it.
maybe that wouldn't be a problem if you didn't make them have ridiculous limitations in the first place. Why not just ban use of the 500 most common passwords (with a list for people to see if their uncreative monstrosity is there) and require a minimum of 8 characters?
142
u/Grintor Mar 08 '16
They don't want 30% of people's password to be abcdef#1
Of course now those people's password is qwerty#1