Well there it is. It's a government website. It needs to be secure. Password restrictions have always annoyed me on websites where it's just my shit that going to get fucked. Yes all of these restrictions will make my shit more secure, but if I want my password to be hunter12 then that should be my perogative. But on a government website it makes sense.
Edit: politeness
Edit 2: Jesus fucking Christ I get it. These types of passwords are more susceptible to brute force passwords. I don't need 20 of you motherfuckers to tell me the same damn thing.
Restrictions like OPs make the site less secure because meow a hacker has a set of rules they can use to pre filter their attack list. Many less combinations to try meow.
In case anyone is interested, here is the information this set of rules is giving a potential attacker, and their consequences:
Passwords must be at least 8 characters in length: means that it's safe to assume that a lot of passwords will be exactly 8 characters in length.
Passwords must include at least one non-alphanumeric printable character: rules out passwords that consist only of alphanumeric characters (order 109 ); very likely that there will be exactly one symbol, and that it will occur either at the start or at the end of the string; good chance the symbol will be one of the four symbols (#, *, $, @) shown in the rules.
Passwords must include at least one number: as above, very likely that there will be exactly one number, and that it will occur at the start or end of the password; good chance that it will be the number 1 or some number between 50 and 98, i.e. year of birth, minus any years with repeated/consecutive numbers.
Passwords cannot contain repeated characters: rules out many more (> 1011 ?) potential passwords that feature runs of the same character. Prevents users from using the string password in their passwords, also stops people from using passwords like $password1, $password2, etc.
Passwords cannot contain (alphanumerically or not?) consecutive characters: this one is incredibly stupid, intended to prevent combinations like 12345, abc, and the like, but forbids many short (2-3 character) combinations that can easily be generated randomly.
It's kind of sad that is quite close to how i do my work password, but with A1, B2, C4, F1, F5, are some of my favorites and I get excited when i use them (make the same stupid joke every time i do my password).
484
u/[deleted] Mar 08 '16 edited Mar 09 '16
Well there it is. It's a government website. It needs to be secure. Password restrictions have always annoyed me on websites where it's just my shit that going to get fucked. Yes all of these restrictions will make my shit more secure, but if I want my password to be hunter12 then that should be my perogative. But on a government website it makes sense.
Edit: politeness
Edit 2: Jesus fucking Christ I get it. These types of passwords are more susceptible to brute force passwords. I don't need 20 of you motherfuckers to tell me the same damn thing.