philosophical: restricting the password space increases security
tldr; Restricting the password space does not help against brute force attacks, but may against intelligent attacks, but there is an even better way.
First off, you're asking the right question, but using the wrong terminology here:
...the second scheme produces passwords that will likely be more resilient to simple brute force attacks.
(I think you mean intelligent attacks.)
A brute force attack is one that attempts every possible combination without added intelligence. Brute force in your example would be something like:
a, b, c, ... y, z, 0, 1 ... 9,
aa, ab, ac, ... ay, az, a0, a1 ... a9, ba, bb, bc ... 99,
aaa ... 999,
aaaa ... 9999,
aaaaa ... 99999,
aaaaaa ... 999999
Anything other than that would be considered an intelligence strategy. For example, before you try brute force, you may be able to save some time with this strategy:
- Attempt only numbers.
- Try words found in a dictionary.
- Try the top X most popular passwords.
- Try combinations of the username or user's initials, current year or last year, etc.
- Try brute force.
Your goal, as the creator of your password, is to make sure that the first 4 options always fail to discover your password. In other words, you need to make sure that the only way to discover your password is by brute force, and also make sure that if brute force is used, that it will take a long time before finding your password. However you do that is up to you, given the constraints of what types of passwords are allowed.
As for your particular question, I would approach it more like a random password generator- it generates one for you, you look at it, and if you believe that it could be guessed with a method other than brute force, you simply generate another random one until you're happy with it. (This would be Scheme 1 with a twist.) If you really wanted to quantify this, you could have your intelligence strategies built and ready to go (all strategies except for brute force). Then you can test them against your randomly generated password and if it is found, you generate another one until all intelligent strategies fail to discover your password. You then would be left with a password which is only discoverable by brute force. Using this method you can achieve better entropy than by restricting the password space in the way you described.
Note: with the password rules you supplied, my twist to Scheme 1 may end up looking somewhat like Scheme 2, however, as the number of allowed characters and password length increases, the Scheme 1 twist should provide more entropy.
I think you have summarized the complexity of the problem nicely, and illustrated why both have pros and cons. The correct answer is of course Scheme 3: Use a longer password, or Scheme 4: Switch to a bank that allows more than 6 character passwords.
You have actually raised an age-old question, which you can find sprinkled around the questions on this site if you browse through the tag passwords: with some (small) probability, a completely random password generator could come up with "password". By putting restrictions on randomness, you are increasing the strength of your worst-case password, at the expense of your entropy. If you can make a good argument for a restriction that does not reduce the entropy significantly, then I think it can be acceptable. Though the general answer is always: if you're worried about the entropy of your password space, use more characters.