Recently I saw the following screenshot on Twitter, describing a obviously terrible password policy:



I wonder what is worse for the password strength. Having no password policy at all or a poor password policy (like described in the screenshot)? 

The question is: worse for what?

With the policy you posted, the possible passwords are less than 64⁸ (~2.8*10¹⁴). In practice, very much passwords will probably be [a-z]*6[0-9][special char] (e.g. aabaab1!) and similar passwords.

All possible passwords with the same characters and length less than 8 are just 64⁷+64⁶+64⁵+... which is ~4.5*10¹². Thats a lot less than the passwords with length 8, so it doesn't increase security much to allow them. (allowing longer passwords would obviously increase security a lot)

Without any policy, many people will also use bad passwords, sure. But an attacker can't be sure about that. Also some people will use better passwords.

Without any policy, an attacker can never be sure how hard it is to crack a password. If you give me a DB of password hashes, I might try to crack it. But if there are no results, after some time I might stop. With the policy in place I can be sure that after 64^8 tries I have all passwords.

I would say, a bad password policy is worse. But it depends on the attack scenario.

With a dump of password hashes, with no password policy it is very likely easier to crack any password but harder to crack most passwords.
With a bad policy like the one given, it is easier to crack all the passwords but slightly harder to crack the first one, most likely.

If your concern is how hard it is to crack your own password, without any policy you can use a secure 20 char random password if you want. With the policy in place, you are forced to use a insecure password. (in practice, it's more relevant how the passwords are stored and so on, but that's out of scope here). So as a user of the website/service, a bad password policy is a lot worse.

If you look at it from an organizational standpoint, a bad password policy is way worse than none.

No password policy means, probably nobody thought about it (not very good that they don't think about security, but ok...)

But a bad password policy means: Somebody thought about it and came up with that crap. This means they probably have no clue about security.

In the end, if you can implement a bad password policy, you can also implement a good one so there is no excuse for a bad password policy ever. Just changing the policy to "A password has to be at least 8 characters" would increase security a lot and isn't hard to do.
