Example strong diceware password:
widow stout harvey crest zomba zloty butyl
This password will be rejected by most sites, for example by Outlook.com. (Notable exceptions: Gmail, Stackoverflow, which seem to accept this very password (tested))
Example modified diceware password that will be accepted by most sites:
Widow stout harvey crest zomba zloty butyl1.
Is this password much stronger than the original one? I doubt.
Example password that will be accepted by most sites (checked on Outlook, which rejected the orignal password):
This password seems to me to be substantially weaker than the one that was originally rejected!!
And yet - in my experience this is what most sites still require.
Given that most does not include Google nor Stackoverflow - is this requirement simply outdated, but most sites still did not catch up? Or are there any actual reasons why lowercase/uppercase/numeric/punctuation is still to be required?