> My first thought here is that if you are going to have such an extreme password policy, you could at least set the minimum password length to ten or even twel

> My first thought here is that if you are going to have such an extreme password policy, you could at least set the minimum password length to ten or even twelve characters Well, and then in reality you have a couple of those old 40 ton host systems lurking in the basement and all its former tamers are long gone, everyone is just glad it is still running and somehow it only allows exactly 8-char passwords with characters and digits only... and somehow it still is one of the most fundamental systems of what you are doing on a day-to-day basis so if you are introducing a central password policy and maybe even a central identity management (which I assume those huge departments are using) then you have to make the bitter decision of accommodating for the "old timer" systems as well or leaving out the proverbial 20% of your systems that see 80% use each day...