I am devising a set of password requirements. I am requiring users to use the following:
- Minimum 8 characters
- Minimum 1 number
- Minimum 1 special character
- Minimum 1 letter (any case)
I would like to replace "Minimum 1 letter (any case)" with "Minimum 1 Uppercase letter".
Would this increase or decrease the security of my user's passwords?
On one hand, I think it would increase the chance that users use a password with a mix of UC and LC. On the other hand, does spelling it out in the password requirements help someone trying to brute force? For instance, if I asked for ONLY uppercase, then it would indicate to an attacker that they only need to try for uppercase.
I understand there are better ways to go about this all, and doing a "pick 3 of 4" would be good, but this is my current situation given working with business-side.