This question already has an answer here:
I came across an interesting password policy online recently:
"Please be sure to enter a password that meets the following criteria:
- must be 8 characters long
- must not be based on dictionary words
- must be different from previous 6 passwords
- must contain at least 1 uppercase character (A-Z)
- must contain at least 1 lowercase character (a-z)
- must contain a leading letter (a-z or A-Z)
- must contain at least 1 number (0-9)
- may contain up to 2 special characters ($ or # only)
- may not have repeating characters
- must be different from user ID"
It seems to me that this narrows down the number of possible passwords so dramatically that it would take appropriately configured hackware all of two minutes to figure out someone's password. Is that approximately accurate?