#2339 Add minimum occurrence for character types in the password generator

[John J Schultz]

Duke Energy is one of several companies beginning to apply additional requirements to characters in their accepted user passwords. They require a minimum of 3 of the character types a user selects: e.g. 3 lower, 3 upper, 3 special character.. in a password of 8-15 in length. Example: CATdog386 or CdA36oTg8 would fulfill the requirements.

I would like to suggest that for each character type checkbox, that you consider adding an up/down control or numeric text box, to specify the minimum number of each character type this is required.. with the default for each being 1. This would be enforced in the generated password.

Thank you.

[Paul]

Why in this day and age do people think applying bizzare rules will make anything more secure?
https://www.passwordping.com/surprising-new-password-guidelines-nist/

To generate a password that fulfills that requirement use this pattern in the generator and tick Randomly permute.
l{3}u{3}s{3}S{6}
https://keepass.info/help/base/pwgenerator.html

cheers, Paul

[John J Schultz]

Thanks Paul. That NIST article needs to go viral. ;)

[T. Bug Reporter]

Well, we're doing what we can here to get the word out, but I do wish there was another page that summarized the NIST report as concisely as PasswordPing does - one that wasn't tied to a commercial product.

Here are some other articles that Google helped me find; none of them is all that commercial, but none of them makes the point as well, either:
The man who put us through password hell regrets everything
Forget Tough Passwords: New Guidelines Make It Simple
New password guidelines from the US federal government via NIST
Unraveling the truth about the NIST's new password guidelines

[Dominik Reichl]

Duplicate of
https://sourceforge.net/p/keepass/feature-requests/2304/

Thanks and best regards,
Dominik