If you are a user and your company implements a password policy that says your password must have at least 8 characters, at least 1 number, at least one alphabet and at least 1 special character, would it be too complex for you as a user to create such a password? I am currently tasked to come up with a complexity policy and was met with objection on the special character part. How hard is it for a normal user to use just at least 1 special character in their password? I mean, is it that hard and would counter productive? Can you share your experiences?
closed as primarily opinion-based by Neil Smithline, Deer Hunter, schroeder♦ Dec 25 '15 at 21:06
Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.
What's far more critical than a diversity of non-alphanumeric symbols is simple password length. Specialized cracking machines* have existed for years that are capable of brute force attacking every combination of letters, numbers, and symbols, up to 10 characters long (given a sufficiently motivated attacker who is willing to spend thousands of dollars on a password cracking computer, of course.) In this environment, quibbling about an exclamation point in an 8 character password is fruitless. Require passwords to be at least 12 or more characters, and you'll have a much more secure solution. If it makes you more comfortable, you can require a digit or upper case character, too. Another mitigation is to use PBKDF2 to store passwords, rendering parallel crackers less efficient.
There are already many questions and answers in security.SE about recommended password policies, you should have a look at those.
* It's an ordinary PC filled with GPU cards and a massively parallel CUDA program to compute SHA-1 hashes; the last time I looked it could compute 348 billion SHA-1 hashes per second. I doubt hardware has gotten slower over time.