I would be much more concerned with Joe picking a bad password that could be guessed by an attacker on the outside. This argument presents a false dichotomy, a

I would be much more concerned with Joe picking a bad password that could be guessed by an attacker on the outside. This argument presents a false dichotomy, as the issue is not how strong to make passwords, but whether there are other security mechanisms that could be used in conjunction with passwords or instead of passwords. My point is that a password places all the blame on Joe instead of on IT, so IT prefers passwords :-)