The flip side of “more and more” rules is that it becomes easier to brute force passwords.
Clearly no password should have the letter z repeated 10 times if it is 15 chars or shorter.
Clearly no password should have the word password in it. If it is shorter than 12.
Two dictionary words in a row, clearly wrong…
And so on. So the space for searching for passwords is shrunk.
This is a rabbit hole, I have changed my mind from yesterday after thinking about this. I am with @codinghorror I don’t think we need to do anything here.