I am the primary developer of a website. During a recent security audit, we got dinged because we display our password standards on the login page.
My contention is that revealing this information does not significantly affect the security because the amount of passwords this information allows a potential hacker is insignificant compared to the total number available.
For example, stating that the password must be at least 8 digits allows them to skip trying all passwords less than 8. However, even compared to just the number of passwords you can create with 8 characters (let alone 9, 10, etc) the number of passwords you can create with 7 or less is tiny. Same principle extends to including numbers, upper case, lower case, etc.
This percentage grows smaller and smaller the longer the password is able to be. Since we do not limit the length of the password, the impact of revealing the requirements is insignificant, bordering on non-existent.
Or am I missing something?
