Password policies are often confusing and might be contributing to weak security. GCHQ has something to say about this.
GCHQ has told firms and individuals that many of the policies enforced around passwords by organisations seeking to bolster their cyber-security aren't that helpful.