I received an email from my web host recently that informed me I had an "insecure" password on one of my email accounts and that I had to change it.
Their definition of what a secure password is as password that contains:
Mixed case - Always use a combination of uppercase and lowercase characters
Numbers - Always use a mixture of numbers and letters
Special Characters - At least one of the following special characters !"£$%^&*()-_=+{}#\@':;.>,<\|?
Length - Your password must be at least 8 characters long
Unique Characters - Your password must contain at least 4 unique characters
Whereas I follow the http://xkcd.com/936/ policy of a very long password (over 40 characters and 166bit of entropy (according to KeePass).
I am trying to think how they know what my password is (in order to tell me the digits it does not contain) without storing it in plain text.
The only "good" idea I have is that they have stored it encrypted and have decrypted it, analysed the plain text for "security", then deleted the plain text. But then I don't like that idea much given how easy it would be to decrypt if the site was compromised and the encryption key presumably also taken.
My other idea was that when I entered my password and before salting and hashing it, they gathered some statistics of the type of characters it contained. This seems unlikely and also a Bad Thing.
Any other ideas how they can do it?