I'm not an expert in this area but my general perception is that all those restrictions make system overall much less secure. This is simply because average use

I'm not an expert in this area but my general perception is that all those restrictions make system overall much less secure. This is simply because average users can't remember lengthy passwords and so they tend to use same password on many website or write it down somewhere insecurely. A much better approach may be just to have user use two or three words as password.