# Convincing client to drop password validation rules

My client wants to include some rules to validate the passwords his clients can choose when creating a new account. Since his company handles sensitive client data, I think I want to convince him to drop some of his desired validation rules for the sake of security. So I started calculating some things, but I got stuck with the second rule.

According to two of the rules, the password can not contain:

• Space characters
• Three of the same character (e.G. ramadan1 or scooter666 would be invalid)

Considering an 8 digit (a-Z 0-9) password:

• All possible combinations including Space (63^8) are 248.155.780.267.521
• All possible combinations without Space are 218.340.105.584.896 (62^8)

this would reduce the possible combinations by roughly 30 trillion for no apparent reason.

But I'm not sure how to calculate how much impact that second rule would have. Can you help me?

• Character restrictions and an 8 character limit seem like they want to integrate with an ancient authentication system in the back end. I'd probe to see if this is the case. Otherwise, if passwords use modern hashes there's no practical reason to create an upper limit on password length that is any smaller than the size of the hashed output. – tjd Apr 5 at 18:41
• 62*62*61*61*60*60...... – tjd Apr 5 at 18:53
• Are you sure the 3 of a char rule is not 3 in a row? Or (more likely) has your client confused this? Because that rule is often enacted to prevent `aaaaaaaa` style passwords. My suggestion is ask them to justify these requirements, and explain every time you make your set of possible passwords smaller, it becomes less secure unless you're offsetting a different danger. – Kevin Mirsky Apr 5 at 20:31
• I haven't quite been able to work out the math, but I have discovered that the term you're looking for is "partial permutation of a multiset". en.wikipedia.org/wiki/Permutation#Permutations_of_multisets Wikipedia, unfortunately, didn't list a formula for that, I couldn't easily find one on Google, and I'm not really up to trying to derive it myself at the moment. Anyway, the reasons why this is a bad idea have less to do with the exact number of passwords it would disallow and more to do with the poor user experience it would create for little to no actual security benefit. – Ajedi32 Apr 5 at 20:42
• Specifically, I'd consider pointing out that the longer a password is, the more likely it is that it will contain three of the same character. "correcthorsebatterystaple", for instance, contains 4 e's, 4 r's, and 4 t's entirely by coincidence and would thus be disallowed by those restrictions. – Ajedi32 Apr 5 at 20:49