Password strength should be measured by bits of entropy, not arbitrary limitations. These forced limitations actually reduce the amount of possible combinations making brute forcing easier. Also, people are likely to compensate for the difficult restrictions by just writing it down. Maybe not a big deal for a one-off government website, but forcing password restrictions like this for a bank account means someone is just going to write it down on a piece of paper or save it in their phone which makes it that much easier for someone to get access to it.
Which I why I said it annoys me when it's just my shit. I should get to pick exactly what password I want for my bank account. I agree with that point.
I was pretty upset work a shit as government website we used to document unclassified training had requirements like that, but my fucking bank was letters and numbers only 8 characters max, no upper case.
153
u/Toribor Mar 08 '16 edited Mar 08 '16
Password strength should be measured by bits of entropy, not arbitrary limitations. These forced limitations actually reduce the amount of possible combinations making brute forcing easier. Also, people are likely to compensate for the difficult restrictions by just writing it down. Maybe not a big deal for a one-off government website, but forcing password restrictions like this for a bank account means someone is just going to write it down on a piece of paper or save it in their phone which makes it that much easier for someone to get access to it.