Does anyone really believe the world needs yet another article bemoaning the common and unpopular practice of imposing arbitrary requirements on passwords?<p>I&#x27;d much sooner read a piece discussing the reasons developers so often make this design choice. Is it a thoughtless formula, a common misconception about how brute-force attacks are conducted, or something else?<p>I&#x27;m far from an expert on the subject, but as an aside, I&#x27;d like to point out that the XKCD comic on the topic seems inconsistent with what I know about how brute-force attacks are usually conducted. To my knowledge, these are usually dictionary-based attacks, which would significantly decrease the &quot;search space&quot; to discover even a long, lower-case sentence. Thus a password with random characters and shorter length might be more secure in practice than a longer password composed of English words.<p>Edit:<p>I&#x27;ve been informed that my layman&#x27;s speculation on the comic was mostly wrong. As I said below, &quot;sorry to be on the other side of the &#x27;infuriating argument with someone who doesn&#x27;t know information theory or security.&#x27;&quot;