Re:The assault on neurosurgeons’ privileges by software and ...
by unprepare on Tuesday December 08, 2015 @08:56AM
(#10696304)
Were these regulations created at a time when brute force password cracking was a legitimate concern?
Password policies do definitely raise the entropy of the passwords, so if the attack vector you're concerned about is entropy sensitive, its a decent strategy.
As someone who has had to enforce such password policies many times, I can say that it's almost always because of some regulatory or certification organization that requires complex policies.
>If you don't you end up with bad passwords.
This is a terrible fallacy that has brought so much pain on the world. The rate of bad passwords is probably not so different, but the rate of frustration is so much higher.