Would it be more secure to enforce "at least one upper case" or to enforce "at least one letter (any case)"

Question

I am devising a set of password requirements. I am requiring users to use the following:

• Minimum 8 characters
• Minimum 1 number
• Minimum 1 special character
• Minimum 1 letter (any case)

I would like to replace "Minimum 1 letter (any case)" with "Minimum 1 Uppercase letter".

Would this increase or decrease the security of my user's passwords?

On one hand, I think it would increase the chance that users use a password with a mix of UC and LC. On the other hand, does spelling it out in the password requirements help someone trying to brute force? For instance, if I asked for ONLY uppercase, then it would indicate to an attacker that they only need to try for uppercase.

I understand there are better ways to go about this all, and doing a "pick 3 of 4" would be good, but this is my current situation given working with business-side.

Answer 1

The effect of a password policy depends on how both users and attackers respond to it. Unfortunately, you can count on your users being lazy and your attackers being creative.

In general, adding more restrictions to passwords has the following effect:

• The effective entropy of a good (that is, random) password decreases a little since all forbidden passwords are removed from the attackers search space.
• The lazy user might gain a little bit (after all, Password1! is better than password). On the other hand, the burden of complying with all the rules might provoke the user to give up and go with a terrible password that passes the test just to get the god damn form to submit.

In the end, this is an empirical question about user behaviour and not a mathematical about entropy calculations. I'd say that both of your alternatives are about equally bad, but that is just a guess. Fortunately, there are better alternatives:

• Drop all conditions (except the lenght one) and instead blacklist leaked passwords.
• Consider easing on the other rules and increase the minimum length instead, to 10 or perhaps 12.

Answer 2

There have been many discussions about password-policies, whenever a question like this comes up, I always post the obligatory XKCD first: https://xkcd.com/936/

But to answer your question: It depends.

If you want to prevent users from using dictionary words, you could go with any of the rules you proposed. But I prefer to hint the users with a text like: "Do not use existing words as your password" in the password form.

When you want to prevent people from re-using their passwords: I'd suggest adding a hint to the password form. "Never choose a password you use somewhere else" instead of trying to come up with some combination of rules that is not used anywhere else.

Finally, when you are trying to 'increase' a password's 'security' against brute force cracking: length is the only thing that really matters. In fact: with a set of password composition rules, the cracker can even exclude a big portion of combinations, so you are only making the password weaker from that perspective.

I would like to replace "Minimum 1 letter (any case)" with "Minimum 1 Uppercase letter".

This would make a dictionary attack slightly more difficult, but 99% of people will uppercase the first letter, and a good cracker tool uses that in their advantage.

Again: there are many discussions about the subject, these are just my 2 cents. I hate it when I am forced to have my password manager make some stupid exception to comply with a elaborate set of requirements.

Instead of bikeshedding over the requirements, just make sure that the passwords are stored securely. Use a strong hash and salt.

Answer 3

Truthfully I doubt it makes much difference either way. With your original rule set most users won't capitalise at all. With your modified rule set most users will capitalise the first letter.

That is the problem with password rules. Users will do the bare minimum to comply with them. So they end up adding much less entropy than you would nievely expect.