Whoever made the decision to implement such a scheme is utterly convinced that his set of rules makes everybody using his site/application more secure.

What's really ridiculous about this is that each password requirement reduces the necessary search space of a brute force dictionary attack, thereby increasing vulnerability. This is true even if people pick completely random passwords that they can also remember (such passwords do not exist, as randomness is the enemy of memory).

For "any 8 character password, made up of alphabetic characters, numbers, and special characters," there are 26 lowercase characters, 26 uppercase characters, 10 digits, and 33 easily-typeable special characters (I speculate that, in practice, the most frequently-used special characters will be in the set [ "'()&!.,?] since those are punctuation people regularly use. The set [@$%&:;] is also likely to see some fans, but after that, most people will ignore the characters. I have not confirmed this. The brackets are only for grouping, they are not part of either set.).

This gives an alphabet of 95 characters. Allowing for passwords of length 1-7 gives Σ(n:1..7) 95ⁿ = 70,576,641,626,495 ~= 7 * 10¹³ potential combinations, meaning that mandating a minimum of 8 characters eliminates 70 trillion possible combinations. Now, in practice, most combinations aren't going to be used; people are much more likely to pick 'password' for their password than 'o?3Qk@FWC' so exhaustive dictionary attacks aren't necessary, and usually the kind of attack that will try to guess passwords only needs one account with a dictionary entry. Also, there are more potential 8 character passwords (95⁸ = 6,634,204,312,890,625 ~=6.6 * 10¹⁵⁾ than potential 1-7 character passwords, so this particular point isn't as huge a deal as it might seem at first glance.

Any requirement of special characters reduces the search space. We know that there's at least one number, one letter, and one special character, so our formula is instead:

10 * 33 * 52 * 95⁵ = 132,780,808,875,000 ~= 1.3 * 10¹⁴ edit: itsjustaride27 points out an error in this value

(Number of digits) * (number of special characters) * (number of alphabetic characters) * (full alphabet)^{5 characters remaining}

This search space is 2% ~56% the size of the search space for only a length 8 requirement, a significant reduction.

The benefit is people are less able to pick dictionary words, but the drawbacks are:

1) The search space to brute force dictionary attacks is reduced (and in practice, most people are going to use something like 'password1.' which is still very vulnerable to dictionary attacks, it's just a matter of changing the dictionary).

2) People can't remember their password, so they record it somewhere, which its own security risk.

Avoiding dictionary words isn't even necessarily a good thing: A password made up of four random words from a 10,000 word vocabulary, each of is a dictionary word, has far more possibilities (10¹⁶⁾ than an eight character password using the full 95-character alphabet.

Here's hoping I didn't make any math errors that invalidate my point.