But I have to fix the user. I could let the user enter any password regardless of password rules, the only rule being it meets the minimum entropy requirements

But I have to fix the user. I could let the user enter any password regardless of password rules, the only rule being it meets the minimum entropy requirements (long enough). Instead, I must make them enter a password that is a minimum of 8 characters with mix of case and symbols. Why? Because it's the industry's best practice. To not follow would open the company to liability, so I do what the other monkeys are doing [1]. [1] - https://security.stackexchange.com/q/33470 https://security.stackexchange.com/q/33470