This question already has an answer here:
In the early days we happily saved whatever password a person wanted to the database.
Later we decided that passwords must include certain characteristics like numbers, upper and lower case and defined lengths (sometimes a max of 8; yikes!).
Not too long after that some of us decided that certain characters like
' (gotta love people fixing sql injection the wrong way) and even repeating sequences like
aaa were no longer allowed.
At some point we finally hashed them and shortly thereafter added a bit of salt.
Now, I'm wondering, do any of the requirements around password "strength" really matter? In other words, if we stripped away all of the characteristics EXCEPT for a minimum length is it just as good?
If my app says, the minimum password length is 12 characters and up to 200 characters - essentially a pass phrase and I allow them to use any character they can type on a keyboard, then is it just as hard to break through the front door? Presuming that I am still hashing with a salt when it's stored in the DB?
-- note: I'm not looking for opinions. I'm looking to see if anyone can provide a "proof" that a 12 character pass phrase is less secure than one which has common limitations identified above.