Are password puzzles a thing?

Question

Security policies have become like puzzles these days. Except for the obvious requirements like alpha-numberic, special symbols and length, there are more arbitrary rules. I've seen even 15 requirements for the password. Something like this:

• not to start with prefix like jan, feb, mar or dictionary words
• at least 3 lower case letters in the first 10
• no particular symbols like '%'
• not symilar to the previous 5 passwords
• no capital letter in the beginning or at all
• no consecutive special characters
• at least 10 but not more than 20 characters

Is coming up with hard ways to remember and create passwords through a puzzle the new thing? Is this a way of telling "You must use a generator for passwords"?

Answer 1

The password rules are often a combination of trying to get people to create passwords with more entropy, and poorly designed password authentication schemes.

I'd make a guess at saying that:

• no particular symbols like '%'
• not more than 20 characters

Likely are the results of poorly designed, or legacy password authentication schemes that can't deal with special characters, or passwords beyond a certain length. Any modern authentication scheme uses hashes in some form or another, which doesn't have any significant length or character limitations.

The rest are increasingly complex attempts at preventing people from creating guessable passwords. I don't think forcing people to use password managers is intentional.

IMHO these are largely misguided attempts to try to force humans into generating more entropy in a password than they're capable of doing. It's misguided because people will come up with clever ways to both have low-entropy passwords, and get around the rules.

Answer 2

Password policies have been this bad for ages, despite we know that passwords should actually

• be long, not too complex; possibly passphrases (xkcd: Password Strength)
• change on suspected compromise, as password expiration policies lead to weaker passwords
• be different for every site; password managers are quite handy.

Yet, bad policies are deeply rooted and even widely spread as "best-practices".

But there are excellent sources, too, like the NIST Digital Identity Guidelines. There are suggestions (section 5.1.1.2) on some actually reasonable things that could be checked and restricted while changing passwords:

When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised. For example, the list MAY include, but is not limited to:

• Passwords obtained from previous breach corpuses.
• Dictionary words.
• Repetitive or sequential characters (e.g. ‘aaaaaa’, ‘1234abcd’).
• Context-specific words, such as the name of the service, the username, and derivatives thereof.

In short, it's about restricting known bad passwords, not enforcing some ridiculous patterns.