security - Password complexity strategies - any evidence for them?

Question

On more than one occasion I've been asked to implement rules for password selection for software I'm developing. Typical suggestions include things like:

• Passwords must be at least N characters long;
• Passwords must include lowercase, uppercase and numbers;
• No reuse of the last M passwords (or passwords used within P days).

And so on.

Something has always bugged me about putting any restrictions on passwords though - by restricting the available passwords, you reduce the size of the space of all allowable passwords. Doesn't this make passwords easier to guess?

Equally, by making users create complex, frequently-changing passwords, the temptation to write them down increases, also reducing security.

Is there any quantitative evidence that password restriction rules make systems more secure?

If there is, what are the 'most secure' password restriction strategies to use?

---

Edit ólafur Waage has kindly pointed out a Coding Horror article on dictionary attacks which has a lot of useful analysis in it, but it strikes me that dictionary attacks can be massively reduced (as Jeff suggests) by simply adding a delay following a failed authentication attempt.

With this in mind, what evidence is there that forced-complex passwords are more secure?

Answer 1

Something has always bugged me about putting any restrictions on passwords though - by restricting the available passwords, you reduce the size of the space of all allowable passwords. Doesn't this make passwords easier to guess?

In theory, yes. In practice, the "weak" passwords you disallow represent a tiny subset of all possible passwords that is disproportionately often chosen when there are no restrictions, and which attackers know to attack first.

Equally, by making users create complex, frequently-changing passwords, the temptation to write them down increases, also reducing security.

Correct. Forcing users to change passwords every month is a very, very bad idea, except perhaps in extreme high-security environments where everyone really understands the need for security.