I believe we *must* have minimum password length at least, and while I agree with you that many systems have really horrible quality rules, it's just not a good practice to let egregiously bad passwords through. It's why I didn't specify what the rules should be. I figured there'd be plenty of debate about that. :)