2 ms·

Why does it even matter? Don't you use a password manager to generate passwords for you?

• kijin 4y ago
  The strings generated by password managers are often incompatible with arbitrary requirements imposed by websites. You must use a symbol, but some symbols are forbidden and we're not going to tell you which ones! You can't have more than N consecutive numbers! Your password is too long! It must be exactly 15 characters long! etc. etc. So I restrict my password manager to use what I consider to be a widely accepted subset of the printable characters, and then some random website will complain about the lack of this or that character. :(
• atoav 4y ago
  Everybody who uses a password manager encounters stupid password rules regularily. It matters, because it is annoying. Password security rules should achieve two goals: 1. Actually improve security 2. Make it easy for users to choose a good password A password policy of "chose one or more lowercase, one or more uppercase, two or more numeric and at least one special character, but not the one that you have been thinking of" does not achieve that goal, especially if they limit the password length to 15 characters. Just tell give them a reasonable minimum length, check against the most common passwords and their username and call it a day. If you need more security, increase the minimum length. Maximum length should be chosen in a way that nobody who is not malicious will notice it (e.g. 128 chars or bigger). This produces safe passwords, is understandable and people with password managers are served as well.