Any password cracking service would crack this in hours. IT people should understand the basics about security before they are allowed to set policy.
Any password cracking service would crack this in hours. IT people should understand the basics about security before they are allowed to set policy.
Not exactly, because you don't know where the special character is. If the allowed characters are k, the number of 8-character passwords would be k^8. With this rule, even assuming that only one special character is used the number becomes 7^k * (3 * 8) = 7^k * 24, so if k ~= 60 the entropy is reduced by roughly 1 bit.
Still, it is an incredibly stupid rule.
Though we know the first and last characters aren't special, so it's actually equivalent to reducing k to 18 for a single character, or 1.85 bits entropy lost by this rule and its interactions with the other rules.
... then the rule that the first and last characters can't be special reduces k from 65 to 62 for them, and the rule that no sets are allowed reduces k by 1 for every character after the first, and so on.
But really, I think the bigger concern is that all of these rules mean the password will end up on a post-it note stuck to the monitor.
Were you running a mod?
After a while I figured out "the trick" and could do them in my head and didn't need the program anymore. It was a fun little programming exercise, though.