I tried to change a Linux password to "sitonapotatopanotis" and got this error:
BAD PASSWORD: is a palindrome
Why does this rule exist?
However, it's not difficult to imagine that there are some password cracking softwares that try palindromes.
I would not recommend using such a password but it's up to you evaluate what security trade-offs you're comfortable with making (you could use
Because a 20-character palindromic password is only as secure as a 10-character password -- there's essentially no extra entropy in the last 10 characters. So you're getting a false sense of security from having a long password.
People are simply more likely to choose "racecar" as their password cause they like it. So those words are high up on all wordlists (which are used before any brute-forcing). And it's simpler to check against all palindromes than to maintain a list of palindromes in the password checking library.
Some passwords are great and some are really bad.
For some passwords, these factors become less relevant or not relevant at all.
Like, this is a great password:
This one, not so much:
Even though it has the same length, if the same password rules apply and you brute-force it, the second password will be tried a lot sooner than the first password.
Let's have a look at this one:
Now, we're rollin' with a serious password! Only that it's almost the worst possible password ever because all letters are used in the same pattern as they appear on a very popular keyboard type.
Someone might look at that password and think it's super awesome because he chooses it under false assumptions (length being most important for a password).
The same could be said for palindromes. First of all, they give a false feeling of security (as Mike notes) because their length is increased by simply duplicating all letters. But the real problem with them is that they are easy to remember and somewhat of a commodity.