Forcing Users To think up More Complex Passwords / Ease of Remembering Them
Are there any guidelines on the play-off between forcing users to have complex passwords (longer, including numbers and special characters etc) - and the reduction in security if users therefore have to write down these passwords because they can't remember them ?
To clarify: what I'm thinking about here is where users may have their own preferred (and memorised) set of passwords, but get forced by sites to start making them longer; or adding a number, or sites which just refuse to accept the password unless the site itself deems it strong enough ( hello Google ). So users then have to think of other passwords that fit these particular criteria - which being non standard ones they are then more likely to write down.
So I guess the question is what do users actually do when confronted with a site which tries to force them to use passwords with particular formatting.