Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently my university updated their password storage procedure, and they have several criteria such as that the password must contain a number, symbol, and uppercase character, and has a length requirement. Realistically, when a brute force / dictionary attack is being performed, doesn't this just make it easier for the person to crack one that works? I understand that this is to prevent people from doing things like "password," but what about one such as "youwillneverguessmypassword" ?

share|improve this question

closed as off topic by maple_shaft, ChrisF Sep 8 '11 at 19:18

Questions on Programmers Stack Exchange are expected to relate to software development within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Of course, there's already an XKCD cartoon for this: – FrustratedWithFormsDesigner Sep 8 '11 at 16:19
Could you elaborate on how "Realistically, when a brute force / dictionary attack is being performed, doesn't this just make it easier for the person to crack one that works? " as I don't see that since there is an increase in the possible combinations which is why it is stronger if one does have a check to prevent standard words or phrases from being used. – JB King Sep 8 '11 at 16:21
That comic was what prompted this - I just couldn't remember where I saw it first. And to clarify, excluding lower-case, text-only passwords eliminates an exponential number of possibilities as the character length increases; the person cracking now does not have to check these. – dave Sep 8 '11 at 16:26
This really should be moved to There are experts there. This has also been discussed in depth there. – Paul Nathan Sep 8 '11 at 17:04
And once it's been moved to, it will be closed as a duplicate of… – Cyclops Sep 8 '11 at 17:38
up vote 6 down vote accepted

Realistically, all the matters for the attacker is that you could use them. It doesn't matter if you actually do, because they still have to enumerate those possibilities, from the perspective of a brute force attack. Having a very long length is a better protection- and even better, you can find apps such as KeePass that will encrypt very long passcodes so you don't even have to remember a different one for every site.

Of course, the restrictions do enforce that you won't be vulnerable to a dictionary attack.

share|improve this answer
What I am thinking is that it would be a better practice to prompt the user that they CAN use any combination of characters/letters/symbols but not FORCE them into any particular pattern with the interest of maximizing the possible number of passwords. – dave Sep 8 '11 at 16:29

It's a Tradeoff

Anytime you add constraints to a password you make it weaker. Conditions reduce the number of possible passwords. You also adding commonality to all the passwords which may or may not be useful in cracking them.

That being said it also prevents people from choosing single character password, english word passwords, etc. These are much easier to crack using things like a dictionary attack.

share|improve this answer

It depends on your assessment of the threat profile and your user community. It definitely helps against the intended profile - of people choosing real words as passwords, and attackers guessing them. On the other hand, it makes it more likely that the passwords will be written down instead of remembered, so the attackers who work by looking for scraps of paper will have more to work with.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.