I am aware of a bank (redacted for obvious reasons) that has the following password policy.

1. Only English alphanumeric characters
2. Min of 8, max of 14 characters
3. No special characters (ex. !@#$%^&* are all forbidden)
4. Passwords must be changed every year
5. Account lockout after 4 bad attempts

What are the specific problems with this policy and how would a would-be bad-actor theoretically attack such a target?

I already sent them a comment arguing that their policy is terrible, especially the 14 char limit (if they use bCrypt they can use up to 72 bytes, IIRC) and the fact that they only allow English alphanumerics instead of any ASCII/Unicode char, hoping they will change their policy to embrace more standard rules.

Edit: I'm not sure why my question is getting downvoted. It's legitimate question and is not answered by this question. Password expiration policy is a minor aspect of my question, not the core query.

I am aware of a bank (redacted for obvious reasons) that has the following password policy.

1. Only English alphanumeric characters
2. Min of 8, max of 14 characters
3. No special characters (ex. !@#$%^&* are all forbidden)
4. Passwords must be changed every year
5. Account lockout after 4 bad attempts

What are the specific problems with this policy and how would a would-be bad-actor theoretically attack such a target?

I already sent them a comment arguing that their policy is terrible, especially the 14 char limit (if they use bCrypt they can use up to 72 bytes, IIRC) and the fact that they only allow English alphanumerics instead of any ASCII/Unicode char, hoping they will change their policy to embrace more standard rules.

I am aware of a bank (redacted for obvious reasons) that has the following password policy.

1. Only English alphanumeric characters
2. Min of 8, max of 14 characters
3. No special characters (ex. !@#$%^&* are all forbidden)
4. Passwords must be changed every year
5. Account lockout after 4 bad attempts

What are the specific problems with this policy and how would a would-be bad-actor theoretically attack such a target?

I already sent them a comment arguing that their policy is terrible, especially the 14 char limit (if they use bCrypt they can use up to 72 bytes, IIRC) and the fact that they only allow English alphanumerics instead of any ASCII/Unicode char, hoping they will change their policy to embrace more standard rules.

I am aware of a bank (redacted for obvious reasons) that has the following password policy.

1. Only English alphanumeric characters
2. Min of 8, max of 14 characters
3. No special characters (ex. !@#$%^&* are all forbidden)
4. Passwords must be changed every year
5. Account lockout after 4 bad attempts

What are the specific problems with this policy and how would a would-be bad-actor theoretically attack such a target?

I already sent them a comment arguing that their policy is terrible, especially the 14 char limit (if they use bCrypt they can use up to 72 bytes, IIRC) and the fact that they only allow English alphanumerics instead of any ASCII/Unicode char, hoping they will change their policy to embrace more standard rules.

Edit: I'm not sure why my question is getting downvoted. It's legitimate question and is not answered by this question. Password expiration policy is a minor aspect of my question, not the core query.