Quote from: Vinz87 on January 09, 2014, 11:07:56 AM

Quote from: pallas on January 09, 2014, 10:55:33 AM

Quote from: aint_no_enthusiast on January 09, 2014, 10:31:20 AM

In your opinion, how does one capital letter in a password raise the security?
Honestly, switch that off. It doesnt make a real difference.

It does a lot.
For example: any way of increasing the size of the char set used to make passwords lowers the risk of successful brute force attacks.

you're right, but if you don't put any boundary on the password choice than the character dictionary is actually made by any character. instead, if you force the user to use a capital letter it means you're actually reducing the dictionary dimension for that character.

if N = all possible characters, there exists:
N^8 8-chars completely free password, and
26+N^7 8-chars passwords with one capital letter

The problem is that if you don't enforce users to use capital letters, numbers and punctuation, they will use just lowercase chars, for lazyness.
Thus, if a hacker brute-forces with lowercase chars, he will be successful on most users.
Actually, brute force attacks works very well with dictionaries, so the real benefit would be not allowing common words, instead of enforcing capitals or numbers.
I have experience of this because I did security audits on unix machines back in the nineties: you could easily find most passwords by using a dictionary + some numbers and mixed caps.