What rule am i proposing? when am i "requiring" a special character?

"correcthorsebatterystaple" is ok, "correct! horse battery Σtaple" is better.

Why are you arguing i shouldn't be allowed to use any key on my keyboard?

There is no reason to disallow any character in a password. let me use them all. limiting to A-Za-z0-9 is goofy and antiquated.

> "correcthorsebatterystaple" is ok, "correct! horse battery Σtaple" is better.

"better" is a dangerous term. Better as for bruteforce guessing resilience? Sure. Better for security? That would be much less certain. Once you discover the users can't enter it on mobile (no Σ on default keyboard) you'd have to provide replacement mechanism for them or allow them to easily reset passwords. Which probably would be the way your security will be compromised soon. And, of course, the users will be losing such fancy passwords at incredible rates, which would generate a lot of noise on "password reset" system which would make it harder for you to detect abuse there. And that not even considering that humans are very bad at avoiding biases and choosing "random" character replacements - they probably would do the same thing in 90% of cases (yes, you are in the 10% of course, but that doesn't change the statistics), like replacing o with 0 and adding ! at the end. Which robots would defeat instantly.

So it's not about forbidding you from using your special characters. It's that using them - on the whole, not for you personally - may not make any improvement, and if you force it, might actually make the matters worse. Encouraging long passwords that one can remember would seems to be actually better. Or doing away with passwords and using something else :)

Not accepting all of unicode is mystifying to me. I've had to localize with code pages in the past. i'm probably scarred in horrible ways which causes a strong bias against the kinds of arbitrary limits people seem to be supporting.

Anyway.

Yeah, hopefully we'll come up with something other than passwords.

For requiring both a number and a special character (out of 10 possibilities): reduces passwords from 46^8 to 46^8 - (36^8 + 36^8-26^8) which is a 27% reduction in password space. I wouldn't call that dramatic and it reduces in importance as the password length grows and, as you bring up biases, it eliminates the most abused password types.

I don't understand your comments about adding digits and special characters at the end of the password. password + digit + special character is strictly harder to guess than just password (we've added two extra characters, after all). Do you mean that people routinely delete the last two letters of their alphabetic password and replace them with 1! ? I find that implausible. The key point is that if you don't require numbers and special characters then no one uses them at all so the possibility space becomes 26^8.

> (we've added two extra characters, after all)

No, the same length just with more restrictions. Your suggesting you replace a min 8 digit password with a minimum 10 digit password but the gain is from adding length not restrictions.

Sadly plenty of passwords are fixed at 8 digits and they reduce the search space below that. So you go from 26^8 to 26^1 x 26^5 and 1! which effectively is just 26^6.

IMO it's reasonable to remove the top 100 or so passwords. But, after that your just reducing the search space.

Do you honestly think that people pick MORE predictable passwords when required to include digits and symbols? I agree that few are very creative with how they use the digits and symbols, but in no way is this lack of creativity greater than the lack of creativity that is exercised when given no constraints. People just love to use a dictionary word or common phrase or ncc1701 as their password and call it done.

100 passwords is nothing compared to a state space of 36^8 = 2.8x10^12. Remove a million or ten if you want. I think you're strongly underestimating how large this space is. Almost any change you can imagine pushes people out of the relatively minuscule space of actually-used-passwords and into the vast barren lands of all-possible-passwords and thereby increases time taken to crack. If you think requiring a number and special character are damaging (since people just have them at the end), then how about the requirement that they have numbers and special characters that are NOT at the end? I've seen this before and it forced me to invent a new password instead of reusing one. It's technically reducing the state space, but it increases the space of passwords that are actually used.

Sure, those 27% of people who actually generated a random password and then happened to get no numbers or special characters are annoyed that they have to generate a new password, but everyone else is picking better passwords.

>Do you honestly think that people pick MORE predictable passwords when required to include digits and symbols?

After looking at lists of user passwords <yes>.

User chosen passwords are generally terrible. If you want users to use secure passwords the correct solution is to generate them and send them to users. Granted, users are going to just write them down at that point.

I really really think you're mistaken. I completely agree that users choose passwords from a tiny subset of the possibilities and that counting the whole state space is a nearly useless measure. But there just HAS to be more variability when users are forced to do something different. Like trying to find someone, or trying to find someone who has been disallowed from being at their home or work that day. The second person is going to be much harder to find, even if they're still really predictable and just end up at the coffee shop across the street.

What lists of user passwords were you looking at? I looked through the default one used by John the Ripper (though they recommend using a larger one for any real purpose) and there were hardly any uses of punctuation at all (exceptions "iloveyou!" and "!@#$%^&*") so I can't make the least bit of conclusions. Reading the list of rules it uses to modify passwords, it prepends and appends digits and punctuation but doesn't seem to delete two characters and then replace them with 1!, or anything similar to that. (Though I'll admit to being inexpert at reading the rule formats and not understanding some). That's as close to empirical data as I've got this side of thinking about how I incorporate symbols and numbers.