I'm not sure where to ask this, but I feel this may be the correct place. I have an assignment where I need to construct a password policy and I've been looking online for certain password policies that big organizations have.
I have found a password policy that states "Strong passwords only: Cannot contain a dot character '.' immediately preceding the '@' symbol"
Why is this a password policy? Does it have something to do with how the password gets hashed?
Rather than answer a question about a specific policy that may be in place to prevent a very specific problem, I'd point you at http://passwordresearch.com/ as a good resource site for helping you get your task done.
When you come up with a solution, be prepared to justify each restriction you place on it. Think about why you might choose to set a minimum length, and what that minimum should be. Do you need a maximum length? Why would you limit it? Are you trying to prevent SQL injection attacks? What would be the purpose for requiring a digit? Every aspect of a policy should be grounded in logic.
