content: I actually strongly disagree that 8 character passwords are sufficient. Consider that every service requires a new password, assuming people bother to make it unique (lol), then they use the service once and forget about it. Will that password still be long enough 15 years from now? How about after the database has been ex-filtrated? Will it withstand sustained off-line attacks? No, asking people to come up with a unique set of 8 random characters for hundreds of identities and memorize them all for life is an unwieldy burden. Passwords are bad.