Hacker News Reader

Knowing a password consists of three random words makes it significantly easier to guess it. Knowing a password contains at least a digit and a special symbol and a upper-case letter does not make the password much easier to guess, and, as others have pointed out, it encourages the use of password managers.

View on HN

Password complexity tends to more harm than good. Users aren't that creative and nearly every password falls into the pattern (A-Z)\w\d!. If we assume that users pad out to the bare minimum length then mandatory complexity actually reduces entropy because we know more specifically what characters are at the beginning and end.

> it encourages the use of password managers

The issue being that the users who have to remember their passwords are often not the same people who decide whether or not to authorise the use of password managers.

Reply on news.ycombinator.com