My biggest pet peeve with password requirements is limiting the scope of special characters to some arbitrary subset, i.e. "you may only use the characters @#$%^& in your password", or not allowing spaces. Without spaces I can't use a phrase without running it all together, and my instinct is to type the spaces, so I end up getting frustrated and using some less secure password instead.
Whenever I see those sorts of limitation I assume there's probably some kind of poorly handled escape situation to exploit and their fix was "well just don't allow that pesky < character"
Comments
My biggest pet peeve with password requirements is limiting the scope of special characters to some arbitrary subset, i.e. "you may only use the characters @#$%^& in your password", or not allowing spaces. Without spaces I can't use a phrase without running it all together, and my instinct is to type the spaces, so I end up getting frustrated and using some less secure password instead.
Whenever I see those sorts of limitation I assume there's probably some kind of poorly handled escape situation to exploit and their fix was "well just don't allow that pesky < character"
Which, in turn, implies that some system handles the password as plaintext rather than via a password-appropriate digest.
Just this week I found that Wordpress cannot handle passwords with ' or " because of bogus "escaping" posted data.