For context. This is Virgin Media which demands your passwords (including e-mail passwords) must be no longer than 10 characters, must begin with a letter, not a number and cannot include any special characters.
Security is not their priority.
Security is not their priority.
[0] https://twitter.com/virginmedia/status/1162756227132198914?l...
Quick! Let's outlaw poverty, violence, theft and coercion, and we're good!
I think they now only ask for the X, Y, and Zth characters, but they used to ask for the whole thing
Having no rules means you have a maximum search space. However, a general audience means that the top X% (lets say 70 to be arbitrary) are going to be in a very small search space... An English word with maybe some numbers substituted in for a letter or two.
OTOH, having password rules means that you eliminate the smallest areas of the search space, so every password resides in a restricted version of the larger space. Fewer possible passwords, but all at a larger complexity to guess.
Then, there are password rules like "no special characters" or "maximum length of 10 characters" which are fantastically stupid and lazy, and only serve to make brute forcing them that much easier.