My client wants to include some rules to validate the passwords his clients can choose when creating a new account. Since his company handles sensitive client data, I think I want to convince him to drop some of his desired validation rules for the sake of security. So I started calculating some things, but I got stuck with the second rule.
According to two of the rules, the password can not contain:
- Space characters
- Three of the same character (e.G. ramadan1 or scooter666 would be invalid)
Considering an 8 digit (a-Z 0-9) password:
- All possible combinations including Space (63^8) are 248.155.780.267.521
- All possible combinations without Space are 218.340.105.584.896 (62^8)
this would reduce the possible combinations by roughly 30 trillion for no apparent reason.
But I'm not sure how to calculate how much impact that second rule would have. Can you help me?