> Why would the attacker assume that the pattern /[a-z]+[A-Z][0-9][:punct:]/ would be any more likely that any other pattern? No need to assume —— large free a

> Why would the attacker assume that the pattern /[a-z]+[A-Z][0-9][:punct:]/ would be any more likely that any other pattern? No need to assume —— large free and open corpora of real user passwords exist. If it is actually more likely to be used by humans, then it’s more likely to be cracked.