Does the act of requiring certain criteria for passwords make them easier to brute-force?

It's always seemed to me that when websites limit the use of "insecure" passwords, it might make it easier for the passwords to be brute-forced because it removes the need for attackers to check any of those passwords. The most basic of these requirements (and probably the most common) would be the need for a password to be 8 characters or longer. It has been discussed in a few other topics:


Do password complexity requirements reduce security by limiting search space?
Insecure to require numbers in passwords?
Doesn't imposing a minimum password length make the password weaker by reducing the number of possible combinations?


The general consensus on this is that requiring longer/harder passwords doesn't necessarily make them easier to crack because most of the passwords it is not allowing aren't probable passwords anyway (because the great majority of people wouldn't use a random string of characters).

I still feel like most people are probably using a password that is the required length or only 1 or 2 characters over the limit. Assuming the use of only alphanumeric characters, requiring 8+ characters removes about 3.5 trillion password possibilities (most of them would just be random gibberish). This leaves ~13 quadrillion passwords that are 8-9 characters. My main question is: Would it make more than a negligible difference in security for websites to only have password requirements sometimes?

Example: Maybe 1/100 attempts to create a password would not need to meet a certain criteria, which would require attackers to test all passwords because of the possibility that the password is less than 8 characters

One related question that you missed in your list is this one:

How critical is it to keep your password length secret?

The accepted answer there (disclaimer: mine) shows that if you have a password scheme which allows all 95 printable ascii characters, then the key space ramps insanely quickly every time you increase the length of the password by 1. You can check all the passwords up to length N in about 1% of the time that it'll take you to check only passwords of length N+1. By rejecting any password shorter than some cutoff length, you give up far less than 1% of your key space.

So, I strongly second @Iszi in saying


  The benefit gained by forcing increased length far outweighs the number of possible passwords lost.




Next point: let's get out of the idea that 8-characters is long for a password. It is not. You say "~13 quadrillion passwords" as if that's a big number. It is not. According to this article (which is a great read btw) his password cracking rig could make 350 billion guesses per second, so every single one of your ~13 quadrillion passwords can cracked one-by-one in ~10 hours. And that's on 2013 hardware, GPUs have come up a lot in power since then.



My opinion is that websites can squabble about who has the better password requirements, but they are all far too weak. Our ability to crack passwords is growing WAY faster than our ability to remember longer ones. This is because security is clashing with usability. Try telling anybody who's not a tech nerd that they need to memorize a 32-character password that doesn't contain any English words, and a different one for each account they have! You'll be laughed at and then ignored. Websites that try to enforce anything better than pathetic password policies have to deal with mountains of angry customers.

The solution is to do away with passwords all together and move towards strong 2-Factor type authentication, where offline cracking isn't feasible. Unfortunately companies have only been seriously thinking about alternatives to passwords for less than a decade and the offerings are far from polished (they are plagued with convenience and usability problems which are preventing mass adoption), so in the meantime we get to continue having these useless debates comparing one mostly useless password scheme against another. End opinion.
