Security policies have become like puzzles these days. Except for the obvious requirements like alpha-numberic, special symbols and length, there are more arbitrary rules. I've seen even 15 requirements for the password. Something like this:
- not to start with prefix like jan, feb, mar or dictionary words
- at least 3 lower case letters in the first 10
- no particular symbols like '%'
- not symilar to the previous 5 passwords
- no capital letter in the beginning or at all
- no consecutive special characters
- at least 10 but not more than 20 characters
Is coming up with hard ways to remember and create passwords through a puzzle the new thing? Is this a way of telling "You must use a generator for passwords"?