Password policies are often confusing and might be contributing to weak security. GCHQ has something to say about this.