Well there it is. It's a government website. It needs to be secure. Password restrictions have always annoyed me on websites where it's just my shit that going to get fucked. Yes all of these restrictions will make my shit more secure, but if I want my password to be hunter12 then that should be my perogative. But on a government website it makes sense.
Edit: politeness
Edit 2: Jesus fucking Christ I get it. These types of passwords are more susceptible to brute force passwords. I don't need 20 of you motherfuckers to tell me the same damn thing.
Restrictions like OPs make the site less secure because meow a hacker has a set of rules they can use to pre filter their attack list. Many less combinations to try meow.
You'd think so, but the fact is that without these restrictions a high number of people would use passwords that are extremely easy to guess (i.e. abcd1234 or some such). With these restrictions, yes, they give a small amount of additional information to the attacker, but they ultimately increase the security of the average user.
Restrictions are a double edged sword: It stops stupid people from making stupid passwords, but each one makes the whole system orders of magnitude less secure. The no consecutive characters alone eliminates billions, possibly trillions of combinations within a reasonable length. Ideally there are other ways to try to prevent stupid people making stupid passwords than to compromise the whole system for everyone.
It's difficult to calculate what the change would be (it may be more than I'm estimating). Like I said in another post, this particular strategy is sort of half-baked, but still, the logic is sound.
2.0k
u/buttonstoyou Mar 08 '16
How about I just go to a new website, how about that.