@damngoodtech @dumbpasswordrules Mathematically correct but functionally wrong. The "best case" password gets worse, but both the worst case and average case get better. Since the best case password is still definitley strong enough under most "complex" schemes, it still meets the goal of better passwords.

That's excluding ridiculous rules like max lengths, of course. And that's not to say there isn't a way to increase password security in a way that isn't infuriating to the humans using them.