There are 100 million more 12-character passwords than 8-character ones, so if you randomly choose from all 8-12 character passwords, it's pretty close to just

There are 100 million more 12-character passwords than 8-character ones, so if you randomly choose from all 8-12 character passwords, it's pretty close to just saying "choose a 12-character password". Let's say the alphabet is 93 characters (lower case, upper case, numbers, and the 31 special characters listed). So consider a random 8- to 12-character string in that alphabet. 1% of the strings have fewer than 12 characters. Lots of them will be legal, but let's eliminate them all to be conservative. 31/93 of the strings start with an illegal character, so that eliminates 33% of the strings. About 10 * 1/97 * 1/97 will have three consecutive occurrences of the same character. That eliminates another 0.1%. (83/93) to the power of 11 will have no numbers. That eliminates 28% of the remainder, or 18% of the total. By the same logic, 1% will have no special symbol. A negligible amount have no letter. One password in a million might contain the user's ID (supposing the IDs are 7-digit strings - either way, it will be negligible). Likewise there aren't many random passwords which will be the user's previous password or contain his name. That eliminated 53% of random passwords, leaving 47% for a loss of very close to one bit of entropy. This analysis wasn't completely rigorous as some of the requirements overlap, but if you try it through simulation I'm sure the result will be between 0.7 and 1.7 bits lost.